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Preface 


Continuing  conflicts  between  violent  groups  and  states  generate  an  ever-present  de¬ 
mand  for  higher  quality  and  more  timely  information  to  support  operations  to  com¬ 
bat  terrorism.  In  particular,  better  ways  are  needed  to  understand  how  terrorist  and 
insurgent  groups  adapt  over  time  into  more-effective  organizations  and  increasingly 
dangerous  threats.  To  adapt,  terrorist  organizations  must  learn.  A  group’s  ability  to 
learn  determines  its  chance  of  success,  since  learning  is  the  link  between  what  the 
group  wants  to  do  and  its  ability  to  gather  the  needed  information  and  resources  to 
actually  do  it.  Despite  the  importance  of  terrorist  group  learning,  comparatively  little 
focused  research  effort  has  been  directed  at  understanding  this  process  and  identify¬ 
ing  the  factors  that  influence  group  learning  ability.  While  relevant  data  and  insights 
can  be  found  in  the  literature  on  terrorism  and  terrorist  organizations,  this  informa¬ 
tion  has  not  been  collected  and  systematically  analyzed  to  assess  its  importance  from 
the  perspective  of  efforts  to  combat  terrorism.  This  study  addresses  that  need  in  an 
effort  to  both  analyze  current  understanding  and  stimulate  further  study  and  research 
in  this  area. 

The  National  Institute  of  Justice  provided  funding  to  the  RAND  Corporation 
to  conduct  an  analysis  of  organizational  learning  in  terrorist  groups  and  assess  its  im¬ 
plications  for  efforts  to  combat  terrorism.  The  work  was  performed  between  Novem¬ 
ber  2003  and  November  2004,  a  period  during  which  the  threat  of  international  ter¬ 
rorism  was  high  and  concern  about  the  capabilities  of  terrorist  organizations  and  how 
they  might  change  over  time  was  a  central  focus  of  policy  debate  and  U.S.  homeland 
security  planning.  The  study  is  described  in  this  report  and  in  a  companion  volume, 
Aptitude  for  Destruction,  Volume  2:  Case  Studies  of  Organizational  Learning  in  Five 
Terrorist  Groups- 332-NIJ,  which  examines  the  innovation  and  learning  activities  of 
five  groups  selected  to  represent  the  spectrum  of  organizations  that  have  used  terror¬ 
ist  tactics. 

This  report  should  be  of  interest  to  a  wide  range  of  audiences,  including  profes¬ 
sionals  with  interests  in  terrorism,  counterterrorism,  emergency  response  planning, 
and  homeland  security.  It  extends  RAND’s  ongoing  research  on  terrorism  and  do¬ 
mestic  security  issues.  Related  RAND  publications  include  the  following: 
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•  Brian  A.  Jackson  et  al.,  Aptitude  for  Destruction,  Volume  2:  Case  Studies  of  Orga¬ 
nizational  Learning  in  Five  Terrorist  Groups,  MG-332-NIJ,  2005- 

•  Brian  A.  Jackson  et  al.,  Protecting  Emergency  Responders:  Lessons  Learned  from 
Terrorist  Attacks,  CF-176-OSTP,  2002. 

•  Kim  Cragin  and  Sara  A.  Daly,  The  Dynamic  Terrorist  Threat:  An  Assessment  of 
Group  Motivations  and  Capabilities  in  a  Changing  World,  MR-1782-AF,  2004. 

•  Peter  Chalk  and  William  Rosenau,  Confronting  the  “Enemy  Within  Security  In¬ 
telligence,  the  Police,  and  Counterterrorism  in  Four  Democracies,  MG-100-RC, 
2004. 

•  Bruce  Hoffman,  Insurgency  and  Counterinsurgency  in  Iraq,  OP-127-IPC/ 
CMEPP,  2004. 

This  research  was  conducted  within  RAND  Infrastructure,  Safety,  and  Envi¬ 
ronment  (ISE),  a  division  of  the  RAND  Corporation.  The  mission  of  RAND  ISE  is 
to  improve  the  development,  operation,  use,  and  protection  of  society’s  essential 
built  and  natural  assets;  and  to  enhance  the  related  social  assets  of  safety  and  security 
of  individuals  in  transit  and  in  their  workplaces  and  communities.  The  ISE  research 
portfolio  encompasses  research  and  analysis  on  a  broad  range  of  policy  areas  includ¬ 
ing  homeland  security,  criminal  justice,  public  safety,  occupational  safety,  the  envi¬ 
ronment,  energy,  natural  resources,  climate,  agriculture,  economic  development, 
transportation,  information  and  telecommunications  technologies,  space  exploration, 
and  other  aspects  of  science  and  technology  policy.  Inquiries  regarding  RAND  Infra¬ 
structure,  Safety,  and  Environment  may  be  directed  to 

Debra  Knopman,  Vice  President  and  Director 

RAND  Infrastructure,  Safety,  and  Environment 

1200  South  Hayes  Street 

Arlington,  Virginia  22202 

703-413-1100 

Email:  ise@rand.org 

http://www.rand.org/ise 
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Summary 


If  a  terrorist  group  lacks  the  ability  to  learn,  its  effectiveness  in  achieving  its  goals  will 
largely  be  determined  by  chance — the  chance  that  its  members  already  have  the  nec¬ 
essary  skills  to  carry  out  operations  and  support  activities;  the  chance  that  its  current 
tactics  are  effective  against  desirable  targets  and  against  current  antiterrorism  mea¬ 
sures;  and  the  chance  that  shifts  made  by  the  group  will  prove  to  be  beneficial.1 
Similarly,  in  a  dynamic  environment,  a  terrorist  organization  that  cannot  learn  will 
not  be  able  to  effectively  adapt  to  new  developments  in  intelligence  gathering  and 
law  enforcement. 

But  when  a  terrorist  group  can  learn — and  learn  well — it  can  act  systematically 
to  fulfill  its  needs,  strengthen  its  capabilities,  and  advance  its  strategic  agenda.  The 
ability  to  learn  allows  a  terrorist  group  to  purposefully  adapt  to  ever-evolving  circum¬ 
stances  by 

•  Developing,  improving,  and  employing  new  weapons  or  tactics  that  can  enable 
it  to  change  its  capabilities  over  time 

•  Improving  its  members’  skills  in  applying  current  weapons  or  tactics 

•  Collecting  and  utilizing  the  intelligence  information  needed  to  mount  opera¬ 
tions  effectively 

•  Thwarting  countermeasures  and  improve  its  chance  of  surviving  attempts  to  de¬ 
stroy  it 

•  Preserving  the  capabilities  it  has  developed  even  if  some  of  its  members  are  lost 


1  While  change  in  the  way  a  group  carries  out  its  activities  is  frequently  indicative  of  learning,  the  occurrence  of 
change  is  not  sufficient  to  indicate  that  organizational  learning  has  occurred.  Changes  are  not  necessarily  inten¬ 
tional;  they  can  be  made  unintentionally  or  for  exogenous  reasons  incidental  to  the  behavior  that  is  changed  (e.g., 
a  change  may  occur  in  one  area  simply  as  a  result  of  a  change  made  in  another).  In  this  study,  we  define  learning 
as  sustained  changes  that  involve  intentional  action  by  or  within  a  group  at  some  point — such  as  one  or  more  of 
the  following:  intentional  seeking  of  new  knowledge  or  new  ways  or  doing  things;  intentional  evaluation  of  be¬ 
haviors,  new  or  old,  that  leads  to  efforts  to  retain  valuable  behaviors  and  discard  others;  and/or  intentional  dis¬ 
semination  of  knowledge  within  a  group  or  among  groups  when  such  knowledge  is  deemed  useful  or  beneficial. 
Furthermore,  we  categorize  as  learning  only  changes  that  are  beneficial  to  the  terrorist  group. 
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A  terrorist  group’s  ability  to  learn  is  therefore  a  primary  determinant  of  the  level  of 
threat  it  poses,  since  learning  is  the  route  through  which  organizations  can  seek  solu¬ 
tions  to  the  problems  that  bound  their  freedom  of  action  and  limit  their  ability  to 
pursue  their  goals  in  changing  operational  and  security  circumstances. 


The  Need  to  Understand  Organizational  Learning 

Discerning  how  terrorist  groups  learn  in  a  dynamic  environment  is  crucial  for  under¬ 
standing  terrorism.  With  increased  understanding  of  group  learning  processes,  intel¬ 
ligence  analysts  and  security  planners  will  be  better  able  to 

•  Assess  the  level  of  threat  posed  by  a  terrorist  organization,  which  can  be  radi¬ 
cally  altered  by  effective  learning. 

•  Design  and  implement  strategies  for  combating  terrorism,  using  knowledge  of 
how  terrorist  groups  use  learning  to  blunt  or  overcome  the  countermeasures  and 
security  systems  intended  to  defeat  their  efforts. 

•  Appropriately  allocate  resources  for  combating  terrorism,  since  terrorist  groups 
that  can  learn  effectively  can  pose  a  more  potent  threat  than  do  organizations 
that  are  unable  to  change  and  adapt. 

An  understanding  of  terrorist  group  learning  can  also  assist  in  developing  metrics  for 
efforts  to  combat  terrorism  by  providing  an  additional  approach  for  assessing  the 
effects  of  countermeasures  on  terrorist  group  capabilities. 


About  This  Study 

This  study  addresses  two  basic  questions: 

•  What  is  known  about  how  terrorist  groups  learn? 

•  Can  such  knowledge  be  used  by  law  enforcement  and  intelligence  personnel  in 
their  efforts  to  combat  terrorism? 

To  answer  these  questions,  we  have  (1)  examined  theory  and  data  about  how 
organizations  learn,  drawn  from  the  organizational  behavior  and  management  litera¬ 
ture,  and  (2)  developed  in-depth  case  studies  of  learning  in  a  variety  of  terrorist 
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groups  through  literature  research  and  interviews  with  intelligence  and  law  enforce¬ 
ment  professionals  who  have  had  direct  experience  with  terrorist  groups.2 

Using  analytical  frameworks  drawn  from  the  organizational-theory  literature  to 
assist  in  framing  questions  about  what  organizations  must  do  to  learn,  we  examined 
terrorist  groups  that  have  been  successful  learners  in  order  to  focus  on  those  behav¬ 
iors  of  greatest  concern.  Discussions  with  intelligence  and  law  enforcement  profes¬ 
sionals  enabled  us  to  explore  the  applicability  and  utility  of  organizational-learning- 
focused  approaches  to  analysis  and  operational  planning  for  combating  terrorism. 

Figure  S.1 

Component  Processes  of  Organizational  Learning 


Information  or 
knowledge  ^ 

acquisition 
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Storage  ^ 
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Terrorist  groups  present  a  moving  target  that  can  prove  very  difficult  to  hit. 
Effective  efforts  to  combat  terrorism  require  the  ability  to  anticipate  how  and  where 
groups  are  evolving  over  time.  Beyond  simply  describing  how  such  groups  change — 
for  example,  tracking  differences  in  weapons  they  use  or  how  well  they  use  them — we 
need  to  understand  the  mechanisms  through  which  those  changes  occur.  Drawing  on 
the  organizational-theory  literature,  we  adopted  a  model  of  learning  as  a  four-part 
process,  comprising  acquiring,  interpreting,  distributing,  and  storing  information 
and  knowledge  (Figure  S.1).  By  breaking  down  the  composite  and  complex  process 
of  “learning”  into  discrete  pieces,  this  model  helps  frame  specific  and  actionable  ques¬ 
tions  about  how  individual  terrorist  groups  learn.  Sufficiently  detailed  information 
on  the  four  subprocesses  in  the  model  could  assist  law  enforcement  and  intelligence 
professionals  in  carrying  out  the  three  key  functions  shown  in  Figure  S.2:  detecting 
terrorist  groups’  efforts  to  change  and  adapt,  anticipating  whether  those  efforts  will  be 
successful,  and  acting  to  limit  terrorist  groups’  ability  to  learn  or  undermine  their 
learning  efforts. 


2  This  approach  has  been  applied  previously  to  the  analysis  of  drug  cartels  and  transnational  criminal  organiza¬ 
tions  (see  Kenney,  2002,  2003b). 
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Figure  S.2 

Phases  of  Law  Enforcement  and  Intelligence  Activity  to  Counter  Terrorist  Group  Efforts 
to  Change  and  Adapt 


Detecting  Terrorist  Groups'  Efforts  to  Change 

Although  the  efforts  of  terrorist  groups  to  adapt  and  learn  are  frequently  easy  to  see 
in  hindsight,  they  are  much  more  difficult  to  detect  before  they  are  fully  realized.  De¬ 
tection  is  critical,  however,  if  terrorist  groups  are  to  be  denied  the  advantage  of  sur¬ 
prise  in  their  tactics  and  operations.  Intelligence  and  law  enforcement  analysts  must 
have  access  to  specific  types  of  information,  the  ability  to  extract  that  information 
from  the  noisy  background  of  collected  intelligence,  and  the  analytical  tools  to  dis¬ 
cern  what  the  information  means  in  terms  of  terrorist  group  adaptive  activities. 
Integrating  an  understanding  of  organizational  learning  into  the  intelligence  collec¬ 
tion  and  analysis  process  could  help  ensure  that  key  information  about  terrorist 
groups’  adaptive  efforts  is  not  overlooked.  Providing  a  structure  for  framing  clear, 
actionable  questions  about  the  specific  processes  of  terrorist  group  learning  could  in¬ 
crease  the  possibility  that  the  right  information  will  be  collected  and  will  therefore  be 
available  to  analysts  studying  particular  groups.  Similarly,  a  clear  model  of  how  ter¬ 
rorist  organizations  learn  would  provide  an  alternative  analytical  framework  for  ex¬ 
amining  new  intelligence.  Such  a  framework  would  help  to  ensure  that  data  signaling 
terrorist  group  learning  activities  are  not  missed  in  the  daily  stream  of  collected  intel¬ 
ligence.  Having  a  clear  understanding  of  organizational  learning  processes  would  also 
provide  a  context  for  assessing  more  fully  the  potential  “learning  implications”  of  a 
terrorist  group’s  current  activities.  Having  such  an  alternative  lens  through  which  to 
view  new  information  could  be  critical — for  example,  individual  operations  that  ap¬ 
pear  detrimental  to  a  terrorist  group’s  interests  from  a  strategic  or  organizational  per¬ 
spective  may  have  very  different  implications  when  viewed  from  the  perspective  of 
the  group’s  learning  goals. 


Key  Findings:  Detecting  Terrorist  Groups'  Efforts  to  Change 

•  Use  frameworks  describing  organizational  learning  by  terrorist  organizations  to 
focus  intelligence  collection  and  ensure  that  necessary  information  is  collected 
and  terrorists'  efforts  to  change  are  not  overlooked. 

•  Use  a  learning-focused  analytical  framework  for  assessing  collected  intelligence 
to  help  capture  and  understand  the  learning  implications  of  group  activities. 
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Anticipating  the  Outcomes  of  Terrorist  Groups'  Efforts  to  Change 

It  is  always  worrisome  when  a  terrorist  group  decides  to  pursue  damaging  new  weap¬ 
ons  or  to  adopt  a  new  tactic.  But  whether  or  not  such  a  decision  actually  increases  the 
threat  posed  by  the  group  depends  on  whether  the  terrorists  can  bring  their  plans  to 
fruition.  Accurately  assessing  the  implications  of  a  shift  in  a  terrorist  group’s  intent  or 
activities — i.e.,  determining  whether  the  threat  it  is  trying  to  pose  is  credible — 
requires  a  judgment  about  the  likelihood  of  the  group  succeeding  in  its  plans.  Be¬ 
cause  successful  learning  dramatically  increases  a  terrorist  group’s  ability  to  do  what  it 
wants  to  do,  understanding  how  the  group  learns  can  help  analysts  anticipate 
whether  the  group  will  succeed  in  its  efforts.  To  better  understand  how  a  terrorist 
group  learns,  the  analyst  can  (1)  examine  the  group  and  its  circumstances  to  assess 
how  their  characteristics  will  affect  its  ability  to  learn  and  (2)  examine  what  the  group 
is  trying  to  accomplish  to  assess  whether  the  strategies  it  has  adopted  will  bring  to¬ 
gether  the  ingredients  needed  to  succeed. 

Earlier  research  has  identified  a  range  of  characteristics  associated  with  a  group’s 
ability  to  learn  effectively.  Details  about  the  nature  of  an  organization’s  structure  and 
interconnections,  its  membership,  its  environment,  and  the  specific  activities  it  is  car¬ 
rying  out  can  all  contribute  to  judgments  about  a  group’s  learning  potential.  Exam¬ 
ining  the  variables  that  affect  a  terrorist  organization’s  ability  to  succeed  (Figure  S.3) 

Figure  S.3 

Characteristics  That  Affect  Terrorist  Group  Learning  Abilities 
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can  enable  analysts  to  better  assess  the  credibility  of  the  threat  posed  by  the  organi¬ 
zation. 

To  learn  successfully,  an  organization  must  combine  different  types  of  knowl¬ 
edge.  Explicit  knowledge — e.g.,  recipes  for  explosive  materials,  blueprints  for  attrac¬ 
tive  targets,  weapons  or  other  technologies — can  be  transferred  readily  to  a  terrorist 
group,  provided  it  can  find  an  appropriate  and  willing  source.  Tacit  knowl¬ 
edge — e.g.,  proficiency  in  mixing  explosives  safely  or  the  military  expertise  and  op¬ 
erational  intuition  needed  to  plan  an  operation  well — is  more  difficult  to  transfer 
from  one  group  to  another.  To  the  extent  that  the  analyst  can  evaluate  the  combina¬ 
tions  of  explicit  and  tacit  knowledge  needed  for  an  organization’s  plans,  he  or  she  can 
assess  the  likelihood  the  organization’s  strategy  for  gathering  that  knowledge  and  im¬ 
plementing  its  plans  will  be  successful. 

Key  Findings:  Anticipating  the  Outcomes  of  Terrorist  Groups'  Efforts  to  Change 

•  Gather  information  about  the  characteristics  of  terrorist  groups'  structures  and 
interconnections,  membership,  environment,  and  activities  that  are  specifically 
relevant  to  assessing  the  likely  outcome  of  their  attempts  to  adapt  and  evolve. 

•Examine  the  varied  paths  and  combinations  of  knowledge  relevant  to  terrorist 
groups'  learning  goals  to  enable  better  assessment  of  the  potential  success  of 
their  efforts  to  learn. 


Acting  More  Effectively  to  Thwart  Terrorist  Efforts 

An  understanding  of  how  terrorist  groups  learn  can  contribute  to  shaping  approaches 
for  combating  terrorism.  Terrorist  groups’  learning  capabilities  define  the  options 
they  have  available  to  defeat  security  measures  and  counter  the  actions  of  security 
forces.  Such  groups  have  devoted  considerable  effort  to  foiling  the  information¬ 
gathering  efforts  of  intelligence  and  law  enforcement  organizations  and  have  in¬ 
formed  their  attack  plans  by  direct  study  and  observation  of  security  forces’  tactics 
and  procedures.  If  the  ways  terrorist  groups  learn  to  get  around  countermeasures  can 
be  understood  and  anticipated,  the  design  and  application  of  those  countermeasures 
can  be  improved.  A  detailed  understanding  of  group  learning  processes  could  make  it 
possible  to  design  countermeasures  to  directly  address  or  even  take  advantage  of  ter¬ 
rorist  groups’  attempts  to  learn.  Targeted  attacks  on  a  group’s  “learning  systems” 
could  degrade  the  group’s  ability  to  adapt  over  time.3  Potential  strategies  include  the 
following: 


3  It  should  be  noted,  however,  that  terrorist  groups  could  respond  to  such  efforts  by  subsequently  altering  their 
learning  processes. 
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•  Limiting  the  terrorist  group’s  access  to  critical  knowledge  resources 

•  Identifying  and  preventing  acquisition  of  novel  technologies  and  weapons 

•  Locating  and  targeting  a  terrorist  group’s  “learning  leadership” — those  indi¬ 
viduals  critical  to  the  ability  to  carry  out  organizational  learning  processes 

•  Identifying  and  breaking  critical  connections  among  terrorist  group  members 

•  Designing  strategies  for  combating  terrorism  to  maximize  the  “learning  burden” 
placed  on  terrorist  groups  and  limit  their  chances  of  adapting  to  get  around  it 

•  Denying  terrorist  groups  the  safe  haven  needed  for  experimentation  and  innova¬ 
tion 

Beyond  simply  seeking  to  prevent  a  terrorist  group  from  learning,  strategies  for  com¬ 
bating  terrorism  could  be  designed  to  shape  group  learning  in  more  subtle  ways. 
With  sufficient  information  on  terrorist  groups’  learning  processes,  intelligence  and 
law  enforcement  organizations  could  potentially  affect  the  nature  and  outcome  of 
group  learning  activities.  Strategies  utilizing  deception,  misinformation,  and  other 
psychological  techniques  could  be  applied  to  steer  terrorist  group  learning  in  specific 
directions  or  influence  the  apparent  results  of  their  efforts.  Such  indirect  approaches 
would  require  significant  knowledge  about  a  terrorist  group’s  learning  efforts  and 
even  then  would  never  be  guaranteed  success,  but  they  could  serve  as  useful  alterna¬ 
tive  or  complementary  tactics. 


Key  Findings:  Acting  More  Effectively  to  Thwart  Terrorist  Efforts 

•  Use  an  understanding  of  terrorist  groups'  learning  capabilities  to  improve 
planning  for  combating  terrorism.  Shape  countermeasures  to  resist  efforts  to 
circumvent  or  defeat  them. 

•  Apply  models  of  terrorist  groups'  learning  behaviors  to  the  design  of  novel 
countermeasures  that  specifically  target  their  ability  to  adapt  and  change. 

•  Seek  out  opportunities  to  use  terrorist  groups'  learning  activities  against  them 
by  guiding  their  efforts  or  shaping  the  outcomes  of  those  efforts  to  reduce  the 
groups'  capabilities  and  potential  threat  levels. 


Conclusions 

Although  no  single  method  or  analytical  approach  will  be  applicable  to  all  terrorist 
groups  in  all  circumstances,  an  understanding  of  how  groups  learn  would  be  a  valu¬ 
able  addition  to  the  intelligence  and  law  enforcement  “tool  box”  for  analysis  and  op¬ 
erational  planning  of  efforts  to  combat  terrorism.  However,  to  gain  such  an  under¬ 
standing,  sufficient  information  about  a  terrorist  group’s  learning  behavior  must  be 
collected  and  available.  Without  the  information  needed  to  discern  how  a  terrorist 
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group  is  structured,  to  describe  its  learning  processes,  and  to  determine  how  its 
learning  efforts  should  be  assessed,  these  approaches  will  provide  little  benefit  to  the 
analyst.  In  some  cases,  such  information  may  be  collected  in  the  course  of  general 
intelligence  gathering  on  a  terrorist  group;  in  other  cases,  specific  efforts  may  be  re¬ 
quired.  Even  for  the  groups  examined  in  this  study — terrorist  organizations  that  have 
been  the  focus  of  significant  analytical  attention  over  many  years — information  on 
the  learning  process  is  not  always  easy  to  find.  Studies  of  groups  carried  out  for  other 
reasons  have  sometimes  provided  insights  about  learning,  but  even  then,  blind  spots 
remain,  particularly  regarding  the  internal  components  of  the  process,  such  as  inter¬ 
pretation  and  decisionmaking  activities,  which  are  perhaps  of  greatest  interest  to  the 
analyst  studying  learning  behavior. 

When  the  necessary  information  is  available,  however,  analytical  frameworks  de¬ 
scribing  organizational  learning  can  be  of  great  value.  By  providing  a  fuller  picture  of 
how  terrorist  groups  try  to  adapt  and  evolve  over  time,  such  frameworks  can  help  in 
understanding  the  behavior  of  individual  groups  and  the  level  of  threat  they  pose; 
developing  effective  counterstrategies  to  detect  and  thwart  their  efforts;  and  appro¬ 
priately  allocating  resources  among  potential  and  proven  adversaries  in  the  context  of 
a  multipronged  approach  to  combating  terrorism. 


Acknowledgments 


The  members  of  the  research  team  would  like  to  extend  their  thanks  to  the  many  in¬ 
dividuals  in  governments,  academic  institutions,  and  other  organizations  around  the 
world  who  gave  generously  of  their  time  and  expertise  as  the  study  progressed.  Study 
workshop  participants  from  a  variety  of  law  enforcement,  homeland  security,  and 
intelligence  agencies  provided  critical  input  that  made  the  analysis  possible.  Because 
of  the  sensitivity  of  the  topics  involved,  these  outside  contributors  are  not  identified 
here,  but  the  necessity  of  maintaining  their  anonymity  in  no  way  diminishes  our 
gratitude  for  their  participation. 

We  gratefully  acknowledge  the  funding  from  the  National  Institute  of  Justice 
that  supported  this  research.  The  direct  assistance  and  support  we  received  from 
Marvene  O’Rourke  and  Sandra  Woerle,  who  served  as  the  NIJ  grant  monitors  for 
this  effort  through  the  period  of  research  and  writing,  were  also  invaluable  in  facili¬ 
tating  our  efforts. 

We  also  gratefully  acknowledge  the  contributions  of  our  reviewers,  Dennis 
Pluchinsky  and  Terrence  Kelly.  The  report  benefited  greatly  from  their  thoughtful 
and  thorough  reviews  and  the  insights  and  suggestions  they  provided. 

A  number  of  our  RAND  colleagues  gave  generously  of  their  time  and  insights. 
We  would  like  to  acknowledge  Claude  Berrebi,  Sara  Daly,  Bruce  Don,  David 
Frelinger,  Scott  Gerwehr,  Bruce  Hoffman,  Angel  Rabasa,  Bill  Rosenau,  and  Mike 
Wermuth.  Susan  Bohandy  of  RAND’s  Research  Communications  Group  provided 
valuable  assistance  and  input  that  greatly  improved  the  report.  Jeremy  Roth  and 
Merril  Micelli  provided  administrative  support  for  both  the  project  workshop  and 
the  overall  project.  Janet  DeLand  also  provided  extremely  valuable  input  during  the 
final  edit  of  the  text  that  greatly  improved  the  readability  of  the  report. 

Finally,  we  would  like  to  acknowledge  Patricia  Touw,  Anduin  Touw,  Craig 
DeAlmeida,  and  Katherine  DeAlmeida,  who  provided  research  and  editing  assistance 
during  various  phases  of  the  study. 


XVII 


Abbreviations  and  Acronyms 


Aum 

Aum  Shinrikyo 

ELF/ALF 

Earth  Liberation  Front/Animal  Liberation  Front 

ETA 

Basque  Fatherland  and  Liberty 
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CHAPTER  ONE 

Introduction 


Early  in  its  campaign  in  Northern  Ireland,  the  Provisional  Irish  Republican  Army 
(PIRA)  faced  a  problem.  Improving  security  forces'  activities  and  the  strengthening 
of  military  bases  and  police  stations  made  it  increasingly  difficult  for  the  Provision¬ 
als  to  stage  attacks  on  these  targets  with  their  preferred  weapons.  To  solve  this  prob¬ 
lem,  PIRA  made  the  decision  to  pursue  a  new  weapon — the  mortar. 

Although  PIRA  could  have  sought  out  mortars  from  the  international  arms 
market,  the  group  chose  to  build  its  own.  Reportedly  drawing  on  knowledge  from 
military  reference  books,  the  Provisionals  began  to  manufacture  mortar  units  in  lo¬ 
cal  machine  shops  and  safe  houses.  PIRA  s  path  to  developing  mortar  technology  was 
not  a  smooth  one.  Early  versions  of  the  weapons  threw  their  shells  far  off  course, 
sometimes  exploding  in  residential  areas  and  schools,  killing  and  maiming  civilians. 
Shells  that  reached  their  targets  often  didn ’t  explode  or  exploded  ineffectively.  Units 
with  design  defects  exploded  in  the  mortar  tube,  killing  the  PIRA  members  at¬ 
tempting  to  use  them. 

PIRA  made  many  modifications  to  their  mortars'  designs  to  correct  their  flaws 
and  better  adapt  them  to  the  group's  operational  needs.  The  Provisionals'  engineers 
observed  the  performance  of  their  creations,  identified  their  shortcomings,  experi¬ 
mented  with  alternative  designs,  and  introduced  the  new  models  into  the  group’s 
arsenal.  Cells  within  PIRA  became  expert  in  the  use  of  the  weapon  and  applied 
their  expertise  both  to  constructing  new  mortar  designs  and  to  applying  the  weapons 
in  high-profile  attack  operations.  The  group  was  innovative  in  its  tactics.  It  built 
mortars  into  vehicles  for  greater  mobility  and  fitted  them  with  timers  so  individual 
Provisionals  could  place  the  weapons  and  disappear  long  before  an  attack  took 
place. 

Over  time,  the  group’s  learning  and  engineering  efforts  paid  off,  and  knowl¬ 
edge  of  how  to  make  and  use  mortars  effectively  was  distributed  among  its  members, 
becoming  a  core  part  of  the  organization’s  capabilities.  The  group’s  perseverance 
reaped  terrible  dividends  late  in  its  operational  career,  as  mortars  made  it  possible 
to  stage  some  of  PIRA s  highest-profile  operations:  a  direct  attack  on  the  British 
Prime  Minister's  residence  at  10  Downing  Street,  multiple  mortar  attacks  on 
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Heathrow  Airport,  and  an  attack  on  the  police  station  at  Ne  wry  which  claimed  the 
lives  of  nine  members  of  the  Royal  Ulster  Constabulary. 1 

Terrorism2  and  insurgent  violence  have  become  constant  threats  in  today’s 
world.  Nearly  every  day,  nonstate  groups  in  different  countries  carry  out  violent  ac¬ 
tions,  many  of  which  can  be  characterized  as  terrorism.  The  threat  of  such  violence 
drives  ongoing  global  military  action,  and  the  need  to  protect  the  U.S.  homeland 
against  terrorist  attack  is  a  primary  shaper  of  the  country’s  domestic  political  agenda.3 

The  experience  of  PIRA  described  above  illustrates  the  importance  of  terrorist 
groups’  ability  to  change  and  adapt.  Faced  with  a  challenge  to  their  operational  capa¬ 
bility,  PIRA  shifted,  adopting  a  new  attack  form  that  reconstituted  the  threat  they 
could  pose.  The  ability  to  modify  tactics  and  behaviors  is  critical  across  all  areas  of 
terrorist  group  operations.4  Such  adaptive  behaviors  can  enable  terrorist  groups  to 

•  Become  more  effective  at  applying  their  chosen  tactics  and  weapons5 

•  Adopt  new,  often  increasingly  damaging  tactics  and  weapons 

•  Alter  their  behavior  in  an  effort  to  fend  off  attempts  to  infiltrate,  undermine, 

and  destroy  them6 

The  ability  of  terrorist  organizations  to  change  their  operations  effectively  over 
time  is  inherently  linked  to  their  ability  to  learn.7  While  changes  in  society,  coun- 


1  Narrative  adapted  from  Bell,  1998b;  Geraghty,  2000;  Glover,  1978;  Hamden,  2000;  O’Callaghan,  1999; 
Urban,  1992. 

2  In  this  report,  we  adopt  the  convention  that  terrorism  is  a  tactic — the  systematic  and  premeditated  use,  or 
threatened  use,  of  violence  by  nonstate  groups  to  further  political  or  social  objectives  to  coerce  an  audience  larger 
than  those  directly  affected.  With  terrorism  defined  as  a  tactic,  it  follows  that  individual  organizations  are  not 
inherently  “terrorist.”  We  use  the  terms  “terrorist  group”  and  “terrorist  organization”  as  shorthand  for  “group 
that  has  chosen  to  utilize  terrorism.” 

3  Though  many  of  the  violent  substate  groups  discussed  in  this  study  use  tactics  that  are  not  purely  terroristic  in 
nature — for  example,  mixing  traditional  military  operations  against  opposing  security  forces  with  terrorist 
bombings  or  assassinations — we  use  “terrorism,”  “terrorist  violence,”  and  “counterterrorism”  as  generic  descrip¬ 
tors  of  groups’  violent  activities  and  government  efforts  to  counter  them. 

4  For  a  variety  of  discussions  of  change  and  adaptation  in  terrorism  and  terrorist  group  activities,  see  Cragin  and 
Daly,  2004;  Crenshaw,  2001;  Gerwehr  and  Glenn,  2003,  pp.  49-53;  Hoffman,  2001;  Jackson,  2001;  Kitfield, 
2001;  Stern,  2003;  Thomas  and  Casebeer,  2004,  pp.  35-38.  We  particularly  acknowledge  Lutes  (2001),  an  un¬ 
published  paper  that  did  not  come  to  our  attention  until  late  in  the  study.  Lutes  brings  the  literature  on  organiza¬ 
tional  learning  to  bear  on  terrorism,  specifically  on  al  Qaeda. 

5  Training  of  group  members  is  a  primary  route  through  which  organizations  carry  out  this  organizational  learn¬ 
ing  function. 

6  This  adaptation  can  include  the  adoption  of  new  learning  behaviors. 

7  While  change  in  the  way  a  group  carries  out  its  activities  is  frequently  indicative  of  learning,  the  occurrence  of 
change  is  not  sufficient  to  indicate  that  organizational  learning  has  occurred.  Changes  are  not  necessarily  inten¬ 
tional;  they  can  be  made  unintentionally  or  for  exogenous  reasons  incidental  to  the  behavior  that  is  changed  (e.g., 
a  change  may  occur  in  one  area  simply  as  a  result  of  a  change  made  in  another).  In  this  study,  we  define  learning 
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termeasures,  or  shifts  in  the  public’s  reactions  to  types  of  attacks  might  provide  the 
motivation  for  change,  a  terrorist  group  cannot  adapt  automatically.  New  tactics  and 
novel  capabilities  do  not  become  available  without  effort.  Terrorist  groups  do  not 
improve  their  ability  to  execute  operations  or  increase  their  level  of  expertise  with 
weapons  simply  because  they  want  to  do  so.  Organizations  must  be  able  to  learn  in 
order  to  identify  opportunities  and  to  have  the  wherewithal  to  take  advantage  of 
them  with  significant  chances  of  success.  The  ability  to  learn  marks  the  difference 
between  a  lucky  organization  that  may  fortuitously  discover  the  solutions  to  its 
problems  and  a  consistently  effective  one  that  can  systematically  act  to  fulfill  its  needs 
and  advance  its  goals  in  a  dynamic  environment. 

Terrorist  groups’  learning  capabilities  pose  a  significant  challenge  to  the  ability 
of  law  enforcement  and  intelligence  organizations  to  protect  the  public.  In  addressing 
the  threat  posed  by  terrorism,  such  organizations  face  three  central  challenges: 

•  Assessing  threats  and  understanding  terrorist  group  behavior.  Understanding 
a  terrorist  group’s  intentions  and  capabilities,  the  types  of  operations  it  may  at¬ 
tempt,  and  its  chances  of  being  successful  when  it  stages  an  operation  is  critical 
for  effective  efforts  to  combat  terrorism.  Because  terrorist  organizations  are 
moving  targets,  the  analyst  must  understand  them  in  a  dynamic  context — not 
just  what  the  organization  is  today,  but  what  it  might  be  tomorrow.  Law  en¬ 
forcement  and  intelligence  organizations  must  also  rapidly  identify  the  groups 
or  individuals  responsible  for  terrorist  incidents  so  that  action  can  be  taken  in 
response. 

•  Developing  and  implementing  counterstrategies.  Proactively  defeating  terror¬ 
ism  requires  the  ability  to  discover  terrorist  group  activities,  gather  needed  evi¬ 
dence  and  intelligence  information,  and  disrupt  operations  and  destroy  group 
infrastructures  and  capabilities.  To  develop  effective  strategies  for  combating 
terrorism,  law  enforcement  and  intelligence  action  must  be  shaped  so  that  it  is 
appropriate  for  the  specific  situations  of  particular  groups  and  the  environments 
in  which  they  operate. 

•  Allocating  resources  and  developing  metrics  to  assess  success  in  combating 
terrorism.  Because  the  resources  that  can  be  devoted  to  combating  terrorism  are 
finite,  decisions  must  be  made  about  how  and  where  those  resources  should  be 
allocated.  Knowledge  of  terrorist  groups’  intent  helps  to  make  those  decisions. 
There  is  less  pressure  to  devote  resources  to  thwarting  the  efforts  of  groups  that 
are  not  interested  in  attacking  a  nation  or  its  interests.  However,  the  remaining 


as  sustained  changes  that  involve  intentional  action  by  or  within  a  group  at  some  point — such  as  one  or  more  of 
the  following:  intentional  seeking  of  new  knowledge  or  new  ways  of  doing  things;  intentional  evaluation  of  be¬ 
haviors,  new  or  old,  that  leads  to  efforts  to  retain  valuable  behaviors  and  discard  others;  and/or  intentional  dis¬ 
semination  of  knowledge  within  a  group  or  among  groups  when  such  knowledge  is  deemed  useful  or  beneficial. 
Furthermore,  we  categorize  as  learning  only  changes  that  are  beneficial  to  the  terrorist  group. 
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groups  frequently  pose  more  potential  threats  than  it  is  possible  to  target  with 
the  resources  available.  Decisions  must  be  made  about  deploying  resources,  and 
metrics  must  be  developed  to  measure  the  results  of  those  decisions  to  ensure 
that  the  most  serious  threats  to  national  security  and  human  life  are  being  ad¬ 
dressed.8 

An  understanding  of  how  terrorist  organizations  learn  may  allow  analysts  to  get  in¬ 
side  a  group’s  efforts  to  change  and  adapt  and  could  thereby  help  the  law  enforce¬ 
ment  and  intelligence  communities  address  all  three  challenges.  Insights  about  ter¬ 
rorist  group  learning  processes  provide  an  approach  to  building  an  understanding  of 
the  dynamics  of  terrorist  organizations,  not  just  by  tracking  data  on  how  they  change 
but  by  exploring  the  ways  those  changes  are  realized.  Such  an  understanding  could 
facilitate  better  threat  assessment  and  could  also  play  a  part  in  assigning  responsibility 
for  past  terrorist  incidents.  Organizations’  “learning  histories”  can  help  identify  what 
group  or  groups  could  plausibly  have  carried  out  specific  attacks. 

In  addition,  an  understanding  of  group  learning  processes  might  also  help  ana¬ 
lysts  identify  and  exploit  key  weaknesses  in  a  group’s  organizational  and  operational 
makeup.  Measures  of  terrorist  group  learning  can  help  to  separate  groups  whose  ca¬ 
pabilities  may  be  bounded  by  an  inability  to  adapt  from  those  that  can  more  readily 
shift  to  pose  greater  levels  of  threat,  providing  a  key  input  to  threat  assessment  and 
resource  allocation. 


About  This  Study 

This  research  effort  addresses  two  basic  questions: 

•  What  is  known  about  how  terrorist  groups  learn? 

•  Can  that  knowledge  be  used  by  law  enforcement  and  intelligence  personnel  in 
their  efforts  to  combat  terrorism? 

To  answer  these  questions,  we  designed  a  methodology  to  explore  why  and 
what  terrorist  groups  learn,  to  gain  insights  into  their  learning  processes,  and  to  iden¬ 
tify  ways  in  which  the  law  enforcement  and  intelligence  communities  might  apply 
those  insights.  The  research  process  comprised  four  main  tasks: 

1.  Review  of  the  literature  on  organizational  learning.  The  rich  literature  on 
learning  in  organizations  is  focused  predominantly  on  learning  in  legitimate 


8  See  Cragin  and  Daly,  2004,  for  a  discussion  of  the  relative  threat  posed  by  terrorist  organizations  as  a  function 
of  their  differing  capabilities  and  intentions. 
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groups,  particularly  commercial  organizations,  but  it  provides  a  wealth  of  models 
and  hypotheses  on  group  learning  practices  that  can  be  applied  to  terrorist 
groups.  Later  phases  of  our  study  were  informed  by  ideas  and  concepts  drawn 
from  this  literature. 

2.  Review  of  available  literature  on  terrorism  and  insurgent  violence.  We  reviewed 
the  published  literature  and  other  data  sources  on  groups  that  have  used  terrorism 
to  assess  what  was  already  known  about  organizational  learning  activities  in  such 
groups  and  to  assist  in  selecting  individual  groups  for  detailed  study. 

3.  Terrorist  group  case  studies.  The  research  process  consisted  primarily  of  prepar¬ 
ing  and  reviewing  a  set  of  case  studies  of  organizations  that  have  used  terrorism  as 
a  component  of  their  violent  activities.  We  selected  five  organizations  for  these 
case  studies:9 

•  Aum  Shinrikyo 

•  Hizballah 

•  Jemaah  Islamiyah  (JI) 

•  Provisional  Irish  Republican  Army  (PIRA) 

•  The  Radical  Environmentalist  Movement 

These  groups,  having  a  variety  of  characteristics,  were  selected  to  cover  the  full 
spectrum  of  organizations  that  have  used  terrorism:  Aum  Shinrikyo  is  a  religious 
cult  that  pursued  chemical  and  biological  weapons;  Hizballah  is  a  social  and  po¬ 
litical  movement  with  insurgent  and  terrorist  aims  and  activities;  JI  is  a  smaller, 
better  defined  terrorist  group  linked  to  and  influenced  by  the  global  jibadist 
movement;  PIRA  is  a  traditional  ethnic  terrorist  group  with  a  long  operational 
history;  and  the  radical  environmentalist  movement  (focusing  on  terrorist  activi¬ 
ties  claimed  by  organizations  identified  as  the  Earth  Liberation  Front  and  the 
Animal  Liberation  Front,  among  others)10  is  an  example  of  a  much  less-defined 


9  A1  Qaeda  was  deliberately  not  selected  to  be  a  case  study  group.  The  goal  of  the  study  was  to  examine  organiza¬ 
tional  learning  across  different  types  of  terrorist  organizations  to  find  commonalities  and  differences  among  their 
experiences.  The  rapid  change  occurring  in  al  Qaeda  during  the  study  period  and  the  volume  of  information 
available  made  it  such  a  complex  subject  that  we  would  not  have  been  able  to  satisfactorily  examine  a  sufficient 
number  of  other  terrorist  groups. 

10  It  should  be  noted  that  the  radical  environmental  movement  is  significantly  different  from  the  other  groups 
examined  in  this  study.  Examining  the  actions  claimed  by  organizations  identifying  themselves  as  the  Earth  Lib¬ 
eration  Front  (ELF),  the  Animal  Liberation  Front  (ALF),  and  others  ffom  the  perspective  that  they  are  carried  out 
by  a  defined  “group”  is  problematic  as  these  organizations  function  as  pieces  within  a  broader  ideological  move¬ 
ment,  rather  than  defined  and  bounded  groups  in  a  traditional  sense.  However,  because  of  assumed  cross¬ 
membership  of  individuals  and  cross-fertilization  among  many  groups  within  the  radical  environmentalist  move¬ 
ment,  law  enforcement  and  counterterrorism  efforts  frequently  treat  ELF,  ALF,  and  affiliated  groups  as  a  single 
organization  for  analytical  purposes,  while  recognizing  that  the  organization’s  diversity  adds  a  unique  dynamic  to 
such  analyses.  In  this  study  we  will  refer  to  these  groups  as  either  radical  environmentalists  or,  for  shorthand  pur¬ 
poses,  ELF/ALF.  Given  the  relevance  of  similar  movements  in  modern  terrorism — e.g.,  extremist  right-wing, 
anti-globalization,  violent  anti-abortion,  and  global  jihad  movements — the  differences  between  the  learning  proc¬ 
esses  of  ELF/ALF  and  those  of  more  traditional  organizations  are  of  significant  interest. 
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terrorist  “front”  of  a  broader  ideological  movement.  These  organizations  are  de¬ 
scribed  in  more  detail  in  the  Appendix  to  this  report. 

In  addition,  to  focus  the  study  on  learning  behavior,  we  chose  terrorist  groups 
that  have  a  reputation  for  innovative  activities.11  The  wide  variety  of  group  types 
selected  was  intentional — addressing  the  study’s  research  questions  required  ex¬ 
amining  the  relevance  and  utility  of  organizational  learning  theories  and  frame¬ 
works  across  a  range  of  terrorist  groups. 

To  provide  a  common  approach  and  structure  for  the  individual  case  studies, 
the  researcher  examining  each  terrorist  group  began  his  or  her  work  with  a  com¬ 
mon  set  of  areas  to  explore,  including  the  group’s  motivations  for  learning,  the 
areas  it  chose  to  learn,  the  outcomes,  and — to  the  extent  possible — how  it  carried 
out  its  learning  efforts.  The  case  study  process  included  review  of  available  pub¬ 
lished  information  on  each  group’s  learning  activities,  supplemented  by  examina¬ 
tion  of  other  information  sources  and  interviews  with  experts  in  the  academic,  in¬ 
telligence,  and  law  enforcement  communities  who  had  direct  experience  with  the 
groups  being  studied. 

4.  Project  workshop.  We  invited  practitioners  from  law  enforcement  and  the  intelli¬ 
gence  community,  along  with  academic  experts,  to  participate  in  a  workshop  held 
concurrently  in  RAND’s  Washington,  DC,  and  Santa  Monica,  CA,  offices  on 
September  29,  2004.  Approximately  25  individuals  participated  in  the  workshop, 
where  discussions  were  held  on  a  not-for-attribution  basis.  The  workshop  focused 


11  Throughout  this  report,  terrorist  groups  that  can  learn  effectively  are  contrasted  with  groups  that  are  not  effec¬ 
tive  learners  and,  as  a  result,  pose  less  serious  levels  of  threat.  Because  of  the  design  of  the  study,  specific  groups 
that  learn  poorly  were  not  examined  in  detail  and  are  generally  cited  as  a  class  rather  than  as  individual  groups. 
Terrorism-incident  databases  and  compendia,  such  as  the  Memorial  Institute  for  the  Prevention  of  Terrorism’s 
Terrorism  Knowledge  Base  (http://www.tkb.org),  provide  a  range  of  examples  of  groups  that  are  poor  learners — 
groups  that  staged  only  single  types  of  attacks  of  limited  effectiveness,  communicated  so  poorly  that  their  agenda 
and  intent  was  difficult  to  discern,  or  were  rapidly  rolled  up  by  security  and  law  enforcement.  It  should  be  noted 
that  even  terrorist  groups  that  one  might  consider  poor  learners  overall  obviously  learned  in  some  areas,  but  their 
inability  to  do  so  in  the  areas  most  critical  to  their  effectiveness  limited  their  impact.  Such  groups  include  the 
following: 

•  The  Tupac  Katari  Guerrilla  Army  in  Bolivia  was  active  for  two  years.  It  had  approximately  100  members  but 
did  not  learn  what  was  needed  to  maintain  its  activities  after  its  leadership  was  captured  (http://www.tkb.org/ 
Group.jsp?groupID=4289). 

•  Terra  Lliure  in  Spain  disbanded  after  approximately  20  years,  during  which  it  never  developed  effective  strate¬ 
gies  to  build  significant  support  among  the  Catalan  population  it  sought  to  champion  (http://www.tkb.org/ 
Group.jsp?groupID=4281). 

•  The  Free  Papua  Movement,  partially  due  to  its  goals  and  ideology,  did  not  pursue  technologies  that  would 
pose  a  significant  threat  (http://www.tkb.org/Group.jsp?groupID=4023). 

•  Black  Star  in  Greece,  which  carried  out  attacks  via  two  tactics — using  gas  canister  bombs  and  setting  cars  on 
fire — demonstrated  neither  the  interest  nor  the  ability  to  carry  out  operational  learning  in  its  attack  modes 
(http://www.tkb. org/Group.jsp?groupID=32). 

A  number  of  other  terrorist  groups  carried  out  only  one  or  a  handful  of  attacks  before  disbanding,  disappearing, 
or  being  arrested  without  any  of  their  stated  goals  accomplished.  Assessing  such  groups  is  difficult,  however,  as 
the  “new”  terrorist  groups  could  be  established  organizations  adopting  a  cover  name  for  a  few  operations. 
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on  practical  insights  into  how  to  improve  the  design  of  policies  for  combating  ter¬ 
rorism.  Starting  with  the  preliminary  results  of  the  case  studies,  the  discussion  ex¬ 
plored  how  analytical  approaches  based  on  organizational  learning  might  be  rele¬ 
vant  and  applicable  to  combating  terrorism. 


About  This  Report 

This  report  synthesizes  the  results  of  the  study,  combining  input  from  the  organiza¬ 
tional  learning  literature,  published  literature  on  terrorist  and  insurgent  groups,  and 
insights  drawn  from  the  case  studies  and  workshop  discussions.  Chapter  Two 
describes  organizational  learning.  Chapter  Three  examines  terrorist  groups’  need  to 
learn  in  order  to  change  effectively.  Chapter  Four  assesses  the  utility  of  understand¬ 
ing  terrorist  group  learning  in  planning  and  implementing  efforts  to  combat  terror¬ 
ism  and,  therefore,  contains  the  core  observations  that  may  be  most  useful  to  law 
enforcement  and  intelligence  agencies  as  they  craft  programs  and  operations  for 
combating  terrorism.  The  report  does  not  present  explicit  recommendations;  rather, 
it  outlines  a  framework  that  should  be  useful  both  for  current  implementation  and 
for  identifying  areas  requiring  further  study.  Chapter  Five  addresses  the  limits  of 
analytical  approaches  based  on  organizational  learning,  and  the  study’s  conclusions 
are  summarized  in  Chapter  Six. 

Although  this  report  uses  selected  examples  and  illustrations  from  the  case 
studies  to  support  its  discussion  of  applying  an  understanding  of  organizational 
learning  to  combating  terrorism,  it  does  not  capture  the  full  richness  of  detail  in¬ 
cluded  in  the  individual  cases.  The  case  studies  are  described  in  detail  in  a  compan¬ 
ion  volume,  Aptitude  for  Destruction,  Volume  2:  Case  Studies  of  Organizational 
Learning  in  Five  Terrorist  Groups,  MG-332-NIJ,  2005. 


CHAPTER  TWO 

What  Is  Organizational  Learning? 


Organizational  learning  is  a  process  through  which  a  group  acquires  new  knowledge 
or  technology  that  it  then  uses  to  make  better  strategic  decisions,  improve  its  ability 
to  develop  and  apply  specific  tactics,  and  increase  its  chance  of  success  in  its  opera¬ 
tions.1  In  short,  learning  is  change  aimed  at  improving  a  group’s  performance;  we 
would  not  call  change  that  is  detrimental  learning. 2 

While  individual  members  of  a  group  must  build  new  skills  and  knowledge  in 
order  for  organizational  learning  to  take  place,  learning  at  the  organizational  level  is 
more  than  simply  the  sum  of  what  each  individual  member  knows  or  can  do.  An  or¬ 
ganization  is  a  system  that  structures,  stores,  and  influences  what  and  how  its  mem¬ 
bers  learn  (Fiol  and  Lyles,  1985;  Hedberg,  1981;  Shrivastava,  1983).  As  such,  it  pos¬ 
sesses  a  “memory”  greater  than  that  of  any  individual  member:  “Members  [of  an 
organization]  come  and  go,  and  leadership  changes,  but  organizations’  memories  pre¬ 
serve  certain  behaviors,  mental  maps,  norms  and  values  over  time”  (Easterby-Smith 
et  al.,  2000).  This  “organizational  memory”  enables  an  organization  to  utilize  the 
capabilities  of  individual  members  to  achieve  group  goals  while  reducing  its  depen¬ 
dence  on  any  one  person.  When  knowledge  is  organizational,  a  group  has  captured 
new  or  expanded  capabilities  in  such  a  way  that  it  does  not  depend  on  particular 
individuals  to  exploit  them. 

Although  they  are  significantly  different  from  the  private-sector  companies  that 
are  the  focus  of  much  of  the  literature  on  organizational  learning,  terrorist  groups  are 
organizations.  To  be  successful,  they  must  change;  and  to  change  effectively,  they 
must  learn.  Operating  in  extremely  volatile  environments,  they  must  capture  their 
learning  at  an  organizational  level  in  order  to  survive.  By  doing  so,  they  gain  critical 
advantages:  They  can  gather  the  information  they  need  more  readily  than  any  single 
individual  could;  they  can  interpret  that  information  through  the  diverse  lenses  of 


1  The  literature  on  organizational  learning  offers  a  range  of  definitions  that  differ  with  regard  to,  for  example, 
what  a  group  must  demonstrate  to  show  learning,  whether  the  process  must  be  intentional,  and  whether  the 
knowledge  gained  must  be  relevant  to  an  organization’s  actions  and  goals.  Our  definition  is  roughly  equivalent  to 
that  ofMiller  (1996). 

2  However,  organizational  processes  that  enable  learning  can  teach  destructive  behavior  if  they  are  misinformed. 
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many  different  members;  they  can  transmit  information  from  an  original  learner  to 
other  group  members,  thereby  reducing  the  risk  of  losing  important  knowledge  if  any 
one  member  is  lost.3  The  following  sections  describe  the  process  of  organizational 
learning  in  terrorist  groups,  drawing  on  illustrations  from  the  description  of  PIRA’s 
acquisition  of  mortar  technologies  presented  in  Chapter  One. 


Organizational  Learning  as  a  Four-Part  Process 

Learning  can  be  characterized  as  a  process  comprising  four  component  subprocesses: 
acquiring,  interpreting,  distributing,  and  storing  information  and  knowledge.4’5  Fig¬ 
ure  2.1  shows  a  model  of  this  process.  All  four  subprocesses  must  be  carried  out  suc¬ 
cessfully  for  knowledge  to  become  organizational — that  is,  clearly  tied  to  group  ob¬ 
jectives,  accessible  to  many  different  group  members,  and  resistant  to  the  loss  of 
individual  members.  The  subprocesses  are  interrelated  and  can  occur  in  different 
orders,  depending  on  context.  For  example,  when  the  individuals  who  acquire  new 
information  or  knowledge  are  also  qualified  to  interpret  it,  there  is  no  need  to  dis¬ 
tribute  it  to  anyone  else  in  the  group  before  it  can  be  utilized.  But  when  the  members 
with  the  expertise  to  make  use  of  new  information  are  not  the  ones  who  collected 
it,  the  information  first  needs  to  be  transferred.  PIRA’s  mortar  development  is  a 
case  in  point.  The  members  who  used  mortars  to  stage  attacks  could  assess  their 

Figure  2.1 
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3  Argyris  and  Schon  (1978)  best  summarize  the  advantages  and  limitations  of  organizational  learning. 

4  Lutes  (2001)  presents  a  similar  four-stage  model,  also  applied  to  terrorist  organizations. 

5  Romme  and  Dillen  (1997)  present  a  brief  but  detailed  treatment  of  organizational  learning  as  an  information 
process.  This  model  also  draws  on  Barnett’s  (n.d.)  description  of  organizational  learning  (cited  in  Lipshitz  et  al., 
2002),  which  defines  it  as  “an  experience-based  process  through  which  knowledge  about  action-outcome  relation¬ 
ships  develops,  is  encoded  in  routines,  is  embedded  in  organizational  memory  and  changes  collective  behavior.” 
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operations,  make  judgments  about  their  use  of  the  devices,  and  apply  tactical  im¬ 
provements  to  the  way  they  used  them.  They  had  no  immediate  need  to  distribute 
this  information  to  other  members  of  the  group.  But  new  technical  information  on 
the  ways  mortars  were  failing  probably  had  to  be  transferred  to  the  group’s  engineers, 
who  could  understand  its  implications  and  apply  it  to  improve  the  next  generation  of 
weapons. 

Acquisition 

In  order  to  learn,  groups  must  acquire  the  information  or  knowledge6  they  need  to 
assess  the  value  of  their  current  activities,  understand  their  effects,  and  identify 
changes  they  need  to  make  to  their  future  behavior  to  improve  performance.  They 
can  both  reach  to  external  sources  for  information  and  mine  the  knowledge  of  their 
own  members. 

Acquiring  Information  or  Knowledge  from  External  Sources 

Organizations  of  all  sizes  obtain  information  and  knowledge  from  external  sources, 
but  small  organizations  are  much  more  likely  to  need  to  look  outside  frequently,  be¬ 
cause  they  can  seldom  find  all  of  the  knowledge  they  need  within  the  group.  Some 
common  external  resources  are  described  below. 

Vicarious  Experience.  Observing  the  activities  of  other  groups  to  glean  insights 
is  the  least  demanding  way  of  gathering  information,  since  it  usually  requires  little 
effort  on  the  part  of  the  observing  group.  Vicarious  experience  usually  provides  only 
incomplete  insights,  however,  because  observers  can  watch  only  the  effects  of  an  op¬ 
eration  and  may  not  gain  all  the  information  or  knowledge  they  would  need  to  du¬ 
plicate  it. 

Cooperation  with  Other  Organizations.  Groups  can  access  information  or 
knowledge  from  other  groups  engaged  in  similar  activities  (Romme  and  Dillen, 
1997).  Different  organizations  can  form  a  variety  of  joint  efforts  and  interactions 
aimed  at  specific  goals.  When  the  aims  and  culture  of  other  organizations  are  com¬ 
patible  with  those  of  the  group  seeking  information  or  knowledge,  such  organizations 
can  be  a  very  valuable  resource.  They  may  be  less  useful  when  their  goals  or  culture 
diverge,  because  these  differences  can  impede  the  flow  of  information  or  knowledge 
between  the  groups  Qones,  1991). 


6  The  difference  between  information  and  knowledge  is  mainly  the  degree  of  relevance  and  adaptation  to  the 
needs  and  applications  of  an  organization.  Information  could  be  any  new  data  that  may  or  may  not  be  useful  and 
may  need  considerable  other  information,  expertise,  etc.,  in  order  to  be  gainfully  applied.  Knowledge  is  more 
“finished” — it  is  already  partially  adapted  to  the  needs  of  a  group  or  comes  with  more  of  the  ingredients  needed 
for  use.  In  the  context  of  the  discussion  in  this  report,  some  sources  of  information  are  likely  to  provide  informa¬ 
tion  rather  than  knowledge,  but  drawing  a  rigorous  distinction  between  the  two  is  not  critical.  In  general,  we  will 
use  knowledge  as  an  inclusive  term  that  can  capture  both. 
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Outside  Human  Resources.  If  a  group  can  locate  the  right  individual  experts,  it 
can  draw  on  their  expertise  either  by  recruiting  them  into  the  organization  or  by  en¬ 
gaging  them  as  consultants. 

Outside  Knowledge  Sources  or  Technologies.  Acquiring  potentially  useful 
technologies  or  other  knowledge  sources — ranging  from  weapons  to  blueprints  of 
desirable  targets — can  rapidly  increase  a  group’s  capabilities.  PIRA’s  acquisition  of 
plans  to  manufacture  mortars  is  an  example  of  a  group  using  an  external  knowledge 
source.  For  certain  types  of  knowledge,  public  and  electronic  sources,  such  as  the  In¬ 
ternet,  can  be  highly  useful.  However,  acquiring  knowledge,  whether  it  is  a  technol¬ 
ogy  or  some  other  source  of  relevant  data,  generally  does  not  mean  that  one  has  all 
the  related  information  required  to  use  that  knowledge  effectively.  Therefore,  groups 
may  need  to  draw  on  other  sources  to  gain  the  additional  required  information. 

Acquiring  Information  or  Knowledge  from  Internal  Sources 

Groups  commonly  gather  or  develop  new  information  or  knowledge  within  their 
ranks.  They  draw  on  three  main  sources:  congenital  knowledge,  direct  experience, 
and  internal  knowledge  development. 

Congenital  Knowledge.  The  information  that  an  organization  inherits  from  its 
founding  leaders  and  members  is  very  important  early  in  its  development.  As  the  en¬ 
vironment  changes  and  the  group  matures,  other  sources  of  knowledge  become  more 
important. 

Direct  Experience  ("Learning  by  Doing").  A  group’s  ongoing  activities  provide 
valuable  information  and  spur  knowledge  development.  Groups  frequently  draw  on 
this  knowledge  source  unintentionally  and  unsystematically  as  they  recognize  mis¬ 
takes  that  offer  lessons  on  how  to  improve  over  time  (Cyert  and  March,  1963).  De¬ 
liberate  efforts  to  garner  information  in  this  way  usually  take  the  form  of  some  sort  of 
evaluation,  such  as  an  after-action  review  or  lessons-learned  process.  PIRA’s  im¬ 
provements  in  their  use  of  mortars  drew  on  information  gained  in  their  initial  fail¬ 
ures;  the  group  was  learning  by  doing. 

Internal  Development  of  Knowledge.  A  group  may  be  able  to  develop  new 
knowledge  internally.  Internal  research  and  development  efforts  can  be  aimed  at  such 
things  as  crafting  new  tactics  and  weapons  to  support  group  operations.  The  devel¬ 
opment  of  mortars  by  PIRA’s  own  engineering  department  is  an  example  of  such  ac¬ 
tivity.  Information  and  knowledge  can  also  be  developed  through  training,  where  a 
group  can  experiment  with  and  test  new  concepts  and  technologies. 

Interpretation 

Without  the  ability  to  assess  the  meaning  and  value  of  information  or  new  knowl¬ 
edge  it  acquires,  a  group  cannot  put  that  information  or  knowledge  to  use  (Huber, 
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1991).  The  group  must  learn  lessons  and  make  judgments  about  three  classes  of  ac¬ 
tivities:7 

•  Current  activities.  Are  the  group’s  actions  effective?  Are  they  moving  the  group 
toward  its  overall  strategic  goals?  How  can  the  group  alter  these  actions  to  make 
them  more  successful? 

•  Possible  future  activities.  Would  a  new  tactic  or  technology  help  the  group?8 
Does  the  group  know  what  it  needs  to  know  to  use  that  tactic  or  technology?  Is 
the  group  likely  to  be  able  to  use  it  successfully? 

•  Older  or  invalidated  knowledge  and  procedures.  Is  older  knowledge  still  useful? 
Are  established  routines  still  effective?  Should  they  be  discarded  in  order  to 
adopt  newer  operating  procedures  (Hedberg,  1981;  McGill  and  Slocum,  Jr., 
1993)? 

For  interpretation  to  be  most  effective,  the  group  must  have  both  the  knowl¬ 
edge  needed  to  make  sense  of  new  information  and  the  time  and  opportunity  to 
think  through  what  it  means.  Being  able  to  interpret  information  within  a  useful 
time  interval  is  also  critical,  and  culture  is  key:  The  group  must  be  open-minded 
enough  to  recognize  when  its  circumstances  have  changed  or  a  particular  approach  is 
not  working,  rather  than  adhering  inflexibly  to  previous  assumptions. 

Distribution 

Distribution  plays  a  critical  role  in  advancing  the  learning  process.  Organizational 
learning  requires  that  knowledge  get  to  the  right  people  in  the  group.  The  more 
broadly  information  is  distributed  within  an  organization,  the  more  likely  it  is  to  be 
interpreted  and  to  be  interpreted  in  multiple  ways,  which  increases  the  likelihood 
that  the  group  will  be  able  to  utilize  it  effectively.  Distribution  also  plays  a  central 
role  in  facilitating  the  storage  of  information  and  increasing  its  availability  for  later 
use.  Effective  distribution  significantly  lowers  the  risk  that  an  organization’s  learning 
will  deteriorate  (Huber,  1991).  However,  for  terrorist  organizations,  this  may  come 
at  the  price  of  increased  vulnerability  to  compromise  and  penetration  because  of  the 


7  Much  of  the  following  discussion  is  framed  in  a  language  consistent  with  viewing  terrorist  groups  and  deci¬ 
sionmakers  as  essentially  rational  actors — interpreting  information  based  on  some  concept  of  the  organization’s 
goals  and  making  decisions  on  the  basis  of  whether  an  activity  does  or  does  not  contribute  to  them.  Other  ele¬ 
ments  of  the  literature  on  terrorist  group  decisionmaking  (reviewed  recently  in  McCormick,  2003)  provide  differ¬ 
ent  “frames”  through  which  to  view  the  interpretation  activities  of  terrorist  groups.  The  analyses  reported  here  do 
not  depend  on  the  specific  decisionmaking  model  appropriate  for  a  given  terrorist  organization;  a  group  can  learn, 
no  matter  what  interpretive  model  it  applies,  and  can  make  rational  decisions  and  choices  within  its  interpretive 
frame,  though  the  specifics  of  its  model  would  be  a  primary  shaper  of  the  aims  of  its  learning  efforts. 

8  Dolnik  and  Bhattacharjee  (2002)  describe  such  a  notional  interpretation  process  regarding  Hamas’s  choice  to 
pursue  and  use  different  types  of  weapons. 
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group  is  already  doing,  discontinuous  change  is  usually  pursued  intentionally  and 
requires  a  more  complex  learning  process  than  continuous  improvement  efforts  do. 

Whether  change  is  continuous  or  discontinuous  is  a  question  of  the  degree  of 
change  involved,  not  of  how  fast  the  change  occurs.  As  a  general  rule,  discontinuous 
learning  tends  to  happen  very  quickly,  while  continuous  improvement  occurs  gradu¬ 
ally  over  a  long  period  of  time.  But  sometimes  small-scale  changes  in  a  group’s  envi¬ 
ronment  can  happen  fast  and  frequently.  The  group  must  be  able  to  respond  rapidly 
to  relatively  minor  changes  through  appropriate  learning  efforts  in  order  to  survive. 


CHAPTER  THREE 

The  Need  to  Learn  in  Order  to  Change  Effectively 


The  effectiveness  of  a  terrorist  group  that  lacks  the  ability  to  learn  will  be  determined 
largely  by  chance — the  chance  that  its  members  already  have  all  the  necessary  skills, 
the  chance  that  its  current  tactics  are  effective  against  desirable  targets  and  against 
current  countermeasures,  and  the  chance  that  any  accidental  or  arbitrary  shifts  the 
group  makes  will  prove  to  be  beneficial.  Since  a  terrorist  group’s  learning  capability  is 
a  key  determinant  of  the  level  of  threat  it  poses,  knowledge  of  that  capability  is  criti¬ 
cal  for  law  enforcement  and  intelligence  planners  in  allocating  resources  for  combat¬ 
ing  the  most  dangerous  terrorist  groups. 

A  terrorist  group  that  can  learn  successfully  can  shape  its  activities  systematically 
to  effectively  pursue  its  organizational  goals.  Analogous  to  the  three  classes  of  group 
interpretation  activities  discussed  in  Chapter  Two,  terrorist  group  activities  must  be 
assessed  in  three  time  frames: 

•  Past  behavior.  A  learning  organization  is  equipped  to  assess  its  tactics  and  stra¬ 
tegic  choices,  make  judgments  about  what  has  worked  and  what  has  not,  and 
determine  whether  or  not  specific  actions  contributed  to  achieving  its  goals. 

•  Current  activities.  A  terrorist  group  that  learns  effectively  is  better  prepared  to 
improve  its  skills  and  can  make  better  choices  in  operational  planning  and  exe¬ 
cution. 

•  Future  actions.  A  learning  organization  is  prepared  to  search  for  and  pursue  new 
opportunities  and  to  assess  how  its  strategy  and  tactics  must  change  if  it  is  to 
remain  effective  and  survive  the  pressures  of  its  environment. 

A  terrorist  group’s  ability  to  learn  at  the  organizational  level  can  make  it  both 
more  effective  and  better  able  to  survive  in  hostile  environments.  If  a  group  is  able  to 
learn  successfully,  it  can 

•  Develop,  improve,  and  employ  new  weapons  or  tactics  to  change  its  capabilities 
over  time 
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•  Improve  its  members’  skills  so  that  they  can  better  apply  its  current  weapons  or 
tactics 

•  Collect  and  utilize  the  intelligence  information  needed  to  mount  operations 
effectively 

•  Thwart  countermeasures  and  improve  its  chance  to  survive  efforts  to  destroy  it 

•  Preserve  the  capabilities  it  has  developed  even  if  individual  group  members  are 
lost 

The  operational  histories  of  many  terrorist  groups,  described  in  our  case  studies 
and  in  the  broader  terrorism  literature,  provide  examples  of  the  organizational  learn¬ 
ing  processes  terrorist  organizations  have  used  in  each  of  these  five  areas,  the  prices 
they  can  pay  for  not  doing  so,  and  the  potential  benefits  of  effective  learning  efforts. 

Development,  Improvement,  and  Employment 
of  New  Weapons  or  Tactics 

A  terrorist  group  has  much  to  gain  by  building 
or  acquiring  new  operational  capabilities  and 
tactics.  The  more  tactics  a  group  has  in  its  rep¬ 
ertoire — from  bombings  to  firearms  attacks  to 
kidnappings  to  unconventional  weapons — the 
greater  its  flexibility  and  operational  freedom.1  Having  a  diverse  range  of  options 
prepares  a  terrorist  group  to  deal  with  complex  situations  and  helps  it  increase  the 
impact  of  its  operations  (Bell,  1998a,  p.  183)  by 

•  Addressing  shifts  in  its  environment 

•  Matching  tactics  precisely  to  operational  needs 

•  Capitalizing  on  new  opportunities 

Addressing  Environmental  Shifts 

Shifts  in  terrorist  groups’  environments  can  gradually  devalue  their  repertoire  of 
attack  options — potentially  to  the  point  where  they  become  ineffectual.  Changes 
ranging  from  improved  security  and  hardening  of  targets  to  shifts  in  the  public’s  re¬ 
action  to  different  types  of  attacks  can  significantly  undermine  a  terrorist  group’s  ca¬ 
pabilities.  Groups  that  are  effective  learners  have  the  opportunity  to  address  such 


1  For  example,  officials  interviewed  during  the  study  estimated  that  over  the  course  of  its  operational  career, 
PIRA  developed  the  ability  to  use  more  than  30  different  kinds  of  weapons,  including  mortars,  rocket-propelled 
grenades  (RPGs),  explosive  devices,  and  firearms  (Jackson,  2005),  which  it  integrated  into  an  even  broader  range 
of  tactical  applications. 


"The  more  tactics  a  group  has 
in  its  repertoire,  .  .  .  the  greater 
its  flexibility  and  operational 
freedom." 
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changes,  modifying  and  diversifying  the  ways  they  stage  operations  and  the  technolo¬ 
gies  they  use  to  do  so.  The  ability  to  unlearn — to  rapidly  discard  previous  modes  of 
operation  when  they  prove  ineffective — is  similarly  essential.  For  example,  when 
elements  of  the  radical  environmental  movement  realized  that  their  operations  in 
wilderness  areas  were  becoming  less  effective  for  advancing  their  agenda,  they  shifted 
their  focus  from  operations  such  as  tree  spiking  to  attacking  suburban  housing  devel¬ 
opments  (Schwarzen,  2004).  This  enabled  the  movement  to  stage  operations  that 
attracted  more  public  attention  and  also  increased  its  visibility.  Aum  Shinrikyo  and 
Hizballah  also  developed  new  types  of  weapons  and  tactics  in  response  to  environ¬ 
mental  change,  sometimes  by  drawing  on  expert  consultants  and  other  sources  of 
outside  knowledge.  Aum’s  learning  was  driven  by  the  perception  that  its  environ¬ 
ment  required  it  to  acquire  unconventional  weapons  to  defend  itself  and  to  advance 
its  apocalyptic  agenda  (Kaplan  and  Marshall,  1996).  Because  of  perceived  changes  in 
its  operational  environment,  Hizballah  shifted  its  operations  from  predominantly  ter¬ 
rorist  attacks  on  international  targets  in  Beirut  toward  more  direct  confrontation 
with  Israeli  forces  in  southern  Lebanon  (Ranstorp,  1997).  Hizballah’s  organizational 
learning  capabilities  enabled  it  to  build  the  guerrilla-warfare  capabilities  needed  for 
success  in  this  second  phase  of  its  conflict. 

Matching  Tactics  to  Operational  Needs 

All  of  the  case  study  groups  acquired  not  only  the  ability  to  use  new  weapons,  but 
also  the  ability  to  manufacture  them.  In  some  groups,  manufacturing  was  quite  lim¬ 
ited  (or  confined  to  single  munitions  types);  for  example,  ELF/ALF  “members” 
manufactured  only  incendiary  devices,  and  JI  produced  only  bombs.  Other  groups, 
such  as  PIRA  and  Hizballah,  developed  full-scale  capabilities  to  manufacture  arms. 
Learning  to  manufacture  weapons  provides  a  terrorist  organization  with  a  more  stable 
and  predictable  source  of  arms,  as  well  as  the  ability  to  customize  weapons  over  time 
so  that  their  capabilities  better  match  their  operational  needs.  To  adapt  to  shifts  in 
Israeli  forces’  tactics,  Hizballah  produced  homemade  claymore-type  antipersonnel 
mines  that  provided  significant  advantages  in  targeting  security  patrols  (Cragin, 
2005).  By  designing  and  building  its  own  RPGs,  PIRA  could  adapt  the  weapons  to 
its  needs  as  a  clandestine  organization.  Because  PIRA  could  obtain  only  a  limited 
number  of  RPGs  from  international  arms  sources,  group  members  fleeing  the  scene 
of  an  attack  had  to  carry  away  the  cumbersome  launchers,  which  made  them  easier  to 
identify  and  apprehend.  By  building  their  own  RPGs,  the  group  could  make  the 
launchers  disposable,  facilitating  escape  after  an  operation  (Jackson,  2005). 

Capitalizing  on  New  Opportunities 

Changes  in  a  terrorist  group’s  security  environment  or  theater  of  operations  can  pro¬ 
vide  new  opportunities.  However,  even  recognizing  that  a  new  opportunity  exists 
may  require  successful  information  gathering  and  interpretative  processes.  Once 
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aware  of  the  potential  for  a  new  target  or  operation,  a  terrorist  group  must  learn  to 
acquire  the  capabilities  required  to  exploit  it.  For  example,  Hizballah  identified  and 
capitalized  on  the  Israeli  targets  abroad  as  potential  attack  sites,  expanding  beyond  its 
traditional  area  of  operation  (Cragin,  2005).  The  Tamil  Tigers — Liberation  Tigers  of 
Tamil  Eelam  (LTTE) — an  innovative  terrorist  insurgency  fighting  the  government  of 
Sri  Lanka,  developed  a  range  of  new  attack  opportunities  through  aggressive  learning 
processes;  for  example,  the  group  exploited  key  opportunities  to  strike  Sri  Lankan 
naval  vessels.  Using  its  knowledge  of  the  navy’s  tactics  and  practices,  LTTE  devel¬ 
oped  a  novel  combination  of  swarming  tactics  with  “wolf  hunter  packs”  of  many 
small  boats  and  a  suicide  boat  packed  with  explosives  to  corner  and  destroy  naval 
patrol  vessels  (Gunaratna,  2001b). 


Improving  Skills  with  Current  Weapons  or  Tactics 

Although  carrying  out  a  terrorist  op¬ 
eration  seldom  requires  tactical  per¬ 
fection,  the  difference  between  the 
impact  of  an  operation  executed  well 
and  that  of  an  operation  executed 
poorly  can  be  considerable.  At  a 
minimum,  poorly  executed  operations 
damage  a  terrorist  group’s  image  as  an  effective  military  organization  and  reduce  its 
chances  of  presenting  the  level  of  threat  necessary  to  achieve  its  goals.  Attacks  that  are 
staged  particularly  poorly  can  result  in  even  more  serious  consequences:  An  attack 
that  kills  too  many  people,  strikes  the  wrong  target,  or  occurs  at  an  inopportune  time 
may  trigger  high-intensity  responses  that  damage  the  group,  derail  other  ongoing  or¬ 
ganizational  efforts,  or  poison  all  popular  support  for  the  group’s  activities  and 
agenda. 

The  potential  impact  of  JI’s  Christmas  Eve  bombing  operation  in  2000  was 
limited  because  almost  half  of  the  38  devices  it  used  did  not  detonate  (International 
Crisis  Group,  2003;  Ressa,  2003).  In  some  cases,  the  price  of  failure  in  terrorist  op¬ 
erations  goes  well  beyond  ineffectiveness:  With  explosive  devices,  for  example,  the 
cost  of  incompetence  can  be  injury  and  death.  The  price  of  such  failures  has  been 
significant  for  some  terrorist  groups.  Early  in  PIRA’s  operational  career,  more  of 
its  members  were  killed  by  their  own  bombs  than  by  the  British  Army  (Bell,  1998b, 
p.  392).  JI  similarly  lost  members  to  premature  detonations  of  its  explosive  devices 
(International  Crisis  Group,  2003;  Turnbull,  2003). 

A  terrorist  group  with  the  ability  to  learn  can  lessen  the  probability  that  it  will 
have  to  pay  such  high  prices.  It  can  evaluate  the  effectiveness  of  its  activities  and  take 
actions  to  improve  its  ability  to  carry  them  out.  In  doing  so,  it  not  only  reduces  the 


"The  difference  between  the  impact  of 
an  operation  executed  well  and  that  of  an 
operation  executed  poorly  can  be  consider¬ 
able.  ...  In  some  cases,  the  price  of  failure 
in  terrorist  operations  goes  well  beyond 
ineffectiveness." 
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chances  that  its  operations  will  go  badly,  it  can  also  build  significant  expertise  within 
the  group,  enabling  it  to  carry  out  increasingly  complex  attacks.  Through  a  variety  of 
learning  measures,  including  learning  by  doing,  use  of  training  to  raise  the  skills  of 
members  and  reduce  the  chance  of  mistakes,  and  carrying  out  “after-action  reviews” 
to  learn  from  past  failures,  all  the  case  study  groups  were  able  to  increase  their  levels 
of  effectiveness  significantly.  JI  substantially  improved  the  reliability  of  its  bombing 
operations  after  the  poorly  executed  Christmas  Eve  bombings  (Baker,  2005).  PIRA’s 
improvement  in  explosives  design  and  use  greatly  reduced  the  group’s  own  fatalities 
per  bombing  operation  over  time  (Jackson,  2005). 

Effective  learning  efforts  also  enable  terrorist  organizations  to  cultivate  high  lev¬ 
els  of  expertise  in  critical  areas  such  as  bomb  making,  sniper  operations,  intelligence 
gathering,  and  logistical  activities.  Internal  experts  give  a  terrorist  group  the  potential 
to  significantly  advance  its  level  of  technological  sophistication.2  PIRA  and  JI  relied 
on  master  bombmakers  to  supply  their  needs.  These  bombmakers  built  up  their  ex¬ 
pertise  in  constructing  explosive  devices  through  constant  learning  by  doing  and  ex¬ 
perimentation.  This  concentration  of  talent  allowed  PIRA  to  develop  standardized 
bomb  “timer  and  power  units”  that  incorporated  necessary  safety  features  and  capa¬ 
bilities  (Geraghty,  2000;  Glover,  1978;  Jackson,  2005). 

Similarly,  Hizballah  formed  expert  units  to  carry  out  specific  functions.  The 
learning  activities  of  such  units  could  be  focused,  enabling  their  members  to  achieve 
significantly  higher  levels  of  expertise.3  Before  such  units  were  formed,  groups  for 
special  tasks  were  drawn  from  the  inner  circle  around  the  terrorist  group’s  leadership. 
While  this  enabled  desired  operations  to  be  carried  out,  it  did  not  allow  broad  im¬ 
provement  in  group  capabilities.  The  transition  to  relying  on  specialized  units  pro¬ 
moted  broader  group  learning  in  specific  areas,  such  as  the  use  of  Ketusha  rockets 
(Cragin,  2005). 


Collecting  and  Utilizing  Intelligence  Information 

Terrorist  groups  depend  on  having  access  to  the  right 
intelligence — knowing  where,  when,  and  how  to 
stage  an  operation  for  best  effect.  The  quality  of  the 
intelligence  available  to  a  terrorist  group  can  mean 
the  difference  between  success  and  failure.  When  a 
group  is  able  to  gather  good  intelligence,  it  can  more 


"The  quality  of  the  intel¬ 
ligence  available  to  a  group 
can  mean  the  difference  be¬ 
tween  success  and  failure." 


2  Although  concentration  allows  the  development  of  higher  levels  of  expertise,  it  also  involves  vulnerabilities.  This 
is  discussed  in  more  detail  in  subsequent  chapters. 

3  LTTE  is  also  reported  to  have  adopted  specialized  units  within  its  group  structure.  These  units  include  a  naval 
force,  an  airborne  group,  special  forces  units,  an  intelligence  service,  and  a  suicide  wing  (Chalk,  2000). 
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readily  identify  potential  targets,  locate  their  vulnerabilities,  and  understand  the  secu¬ 
rity  measures  intended  to  protect  them.  The  right  kinds  of  intelligence  can  also  pro¬ 
vide  information  to  guide  terrorist  groups’  strategy  development  and  inform  them  on 
how  law  enforcement  and  intelligence  organizations  and  the  public  are  reacting  and 
responding  to  the  groups’  operations.  Intelligence  can  be  obtained  incidentally — 
“filtering  up  without  a  real  system”  (Bell,  1998b,  p.  472) — but  such  opportunistic 
intelligence  is  not  sufficient  for  consistent  effectiveness.  Consequently,  many  groups 
make  intelligence  gathering  a  very  high  priority  and  develop  specific  learning  pro¬ 
cesses  and  systems  for  this  purpose. 

In  preparing  for  specific  operations,  many  terrorist  groups  have  standardized 
approaches  for  ensuring  that  the  right  information  is  gathered.  The  intelligence  pro¬ 
cesses  of  the  case  study  groups  focus  on  identifying  attractive  targets  and  discerning 
vulnerabilities  that  can  be  exploited.  Reflecting  the  common  needs  of  clandestine  or¬ 
ganizations  planning  violent  operations,  groups  as  different  as  JI  and  the  ELF/ALF 
terrorist  movement  describe  common  methods  of  collecting  preattack  intelligence, 
including  video  and  photographic  surveillance  ( White  Paper:  The  Jemaah  Islamiyah 
Arrests  and  the  Threat  of  Terrorism,  2003,  p.  28(fn);  Gunaratna,  2002,  pp.  188-189; 
Leader  and  Probst,  2003,  p.  42), 

Many  terrorist  groups  maintain  networks  of  individuals  to  feed  information 
back  into  the  organization.  These  groups  frequently  develop  sources  within  the  gov¬ 
ernment  and  security  agencies  that  oppose  them,  either  by  infiltrating  them  or  by 
recruiting  operatives  who  are  already  members  of  those  agencies.  PIRA  used  such  ac¬ 
cess  to  gather  information  on  security  forces’  activities  and  to  obtain  the  names  of 
members  of  law  enforcement,  intelligence,  and  military  organizations  to  target  for 
attack  (Harnden,  2000;  Jackson,  2005).  ELF/ALF  “members”  seek  to  infiltrate  tar¬ 
geted  organizations  in  order  to  collect  information  on  the  organizations’  security 
measures  and  to  collect  “evidence”  of  their  environmentally  damaging  activities  for 
use  in  postattack  propaganda  (Hendley  and  Wegelian,  1993).  Flizballah  and  PIRA 
collect  intelligence  on  the  tactics  of  the  security  forces  that  oppose  them  and  their 
reactions  in  specific  situations  (Cragin,  2005;  Harnden,  2000,  p.  199).  This  has  al¬ 
lowed  the  terrorist  groups  to  design  specific  operations  that  anticipated  and  exploited 
the  security  forces’  own  tactics,  increasing  the  effectiveness  and  lethality  of  the  ter¬ 
rorists’  attacks. 

Intelligence  can  also  sometimes  provide  terrorist  groups  with  public  relations 
victories.  In  the  1970s,  PIRA  obtained  and  publicized  a  top-secret  British  military 
assessment  of  the  group  that  concluded  that  PIRA  “could  not  be  defeated”  (Coogan, 
1993,  p.  283);  this  bit  of  intelligence  obviously  benefited  the  group’s  morale. 

Because  of  the  importance  of  being  able  to  gather  necessary  intelligence,  the  case 
study  groups  devoted  considerable  effort  to  maintaining  and  improving  their  ability 
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to  do  so.4  To  build  their  organizations’  capabilities,  several  terrorist  groups  included 
specific  intelligence  training  in  their  members’  regimen  and  covered  the  topic  in  their 
organizational  operations  manuals.  LTTE,  a  group  with  a  reputation  for  the  effec¬ 
tiveness  of  its  intelligence  activities,  reportedly  carries  out  specific  after-action  reviews 
of  operational  successes  and  failures  to  strengthen  this  particular  learning  activity 
(Gunaratna,  2001a). 


Thwarting  Efforts  to  Combat  Terrorist  Activities 

Viewed  from  a  learning-centered  perspective, 

change  the  environment  of  the  terrorist  group, 
making  its  current  knowledge  and  capabilities 
obsolete.  Security  measures  seek  to  make 
available  weapons  ineffective.  Intelligence  and  law  enforcement  operations  seek  to 
circumvent  groups’  security  measures,  thereby  compromising  members  and  degrad¬ 
ing  group  capabilities.  Effective  learning  makes  it  more  likely  that  terrorist  organiza¬ 
tions  will  be  able  to  overcome  the  actions  aimed  at  defeating  them. 

Terrorist  groups  undertake  a  range  of  defensive  counterintelligence  and  opera¬ 
tional  security  measures  to  protect  themselves.  PIRA  has  used  everything  from  basic 
measures  such  as  posted  lookouts  beating  trash-can  lids  as  warnings  to  sophisticated 
electronic  surveillance  and  compromising  security  forces’  communications  systems 
(Bell,  1998a,  pp.  197-198;  Foreign  and  Commonwealth  Office,  Republic  of  Ireland 
Department,  1972;  Urban,  1992,  pp.  113-1 14).  By  giving  the  terrorist  group  a  win¬ 
dow  on  security  force  actions,  such  learning  efforts  allowed  PIRA  to  move  operatives, 
carry  out  logistical  tasks,  and  initiate  operations  more  safely.  In  response  to  infiltra¬ 
tion  by  security  forces  that  resulted  in  the  compromise  of  terrorist  group  operations 
and  the  arrest  of  group  members,  some  groups  have  made  significant  modifications 
to  their  structures  and  activities.  Both  PIRA  and  Hizballah  restructured  themselves  to 
institutionalize  lessons  they  learned  about  protecting  themselves  from  infiltration.5 

Terrorist  groups  have  also  made  significant  tactical  changes  to  counter  security 
forces’  ability  to  capitalize  on  vulnerabilities  they  created.  For  example,  although 
Hizballah  acquired  tube-launched,  optically  tracked,  wire-guided  (TOW)  antitank 


a  central  goal  in  combating  terrorism  is  to 


"Effective  learning  makes  it 
more  likely  that  terrorist  organiza¬ 
tions  will  be  able  to  overcome  the 
actions  aimed  at  defeating  them." 


4  The  importance  of  terrorist  groups’  capabilities  in  intelligence  activities  emphasizes  the  role  that  state  sponsors 
can  play  in  transferring  this  type  of  knowledge.  Hizballah  benefited  from  intelligence  training  from  Iran  early  in 
its  operational  development,  training  that  strengthened  the  group’s  ability  to  carry  out  key  functions  (Cragin, 
2005).  Analogous  assistance  was  reportedly  provided  to  the  Tamil  Tigers  by  the  Indian  Intelligence  Service 
(Davis,  1996). 

5  Basque  Fatherland  and  Liberty  (ETA)  reportedly  undertook  a  similar  reorganization  to  increase  its  security  and 
resilience  to  security  pressures  and  other  countermeasures  (Tucker,  2001,  p.  139). 
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missiles  and  training  in  how  to  use  them  from  its  state  sponsors,  using  the  missiles 
the  way  they  were  taught  created  significant  vulnerabilities  for  the  group.  Instead  of 
using  the  TOW  missiles  from  open  areas  exposed  to  rapid  counterattack,  Hizballah 
had  to  learn  on  its  own  and  develop  doctrine  for  using  them  in  more  concealed  or 
defensible  areas  (Susser,  2000).  To  counter  law  enforcement’s  ability  to  gather  in¬ 
formation  on  them  and  their  members,  PIRA  and  components  of  the  ELF/ALF 
movements  both  developed  strategies  to  limit  the  evidence  left  behind  at  operations, 
including  practices  directly  aimed  at  countering  forensic  science  investigation  meth¬ 
ods  and  the  use  of  secondary  devices  to  destroy  residual  evidence  (Chalk,  2001; 
Geraghty,  2000;  Long  and  Denson,  1999;  workshop  discussions).6 

Successful  learning  is  also  critical  for  circumventing  technologies  aimed  at  re¬ 
ducing  the  attack  capabilities  of  terrorist  groups  or  compromising  their  security.  In 
PIRA’s  multidecade  conflict  in  Northern  Ireland,  a  key  focus  of  security  force  activi¬ 
ties  was  the  discovery  and  prevention  of  detonation  of  the  bombs  that  were  a  central 
part  of  the  terrorist  group’s  arsenal.  The  development  of  countermeasures  to  re¬ 
motely  detonated  explosives  triggered  successive  rounds  of  innovation  by  PIRA  to 
break  through  the  defensive  measures  (Collins  and  McGovern,  1998;  Geraghty, 
2000;  Glover,  1978).  Similar  measure-countermeasure  interactions  occurred  in  other 
case  study  groups  as  well.  For  example,  use  of  metal  detectors  to  identify  trees  that 
had  been  “spiked”  by  ELF  members7  led  the  terrorist  group  to  utilize  spikes  that 
were  not  made  of  metal.8  This  adaptation  reconstituted  the  group’s  ability  to  use  the 
spiking  tactic. 


Preserving  Organizational  Capabilities  Despite  the  Loss 
of  Group  Members 

The  nature  of  terrorist  groups’  activities  involves  risk  to  individual  members.  When 
supporting  or  carrying  out  violence,  there  is  always  the  potential  that  individuals  will 
be  killed  or  apprehended  and  the  knowledge  and  expertise  they  carry  will  be  lost  to 
their  organization.  Therefore,  the  ability  of  a  terrorist  group  to  truly  carry  out  organi¬ 
zational  learning — where  capabilities  are  shared  or  stored  in  such  a  way  that  they  are 


6  PIRA  efforts  to  prevent  law  enforcement  information-gathering  activities  included  the  extreme  strategy  of  di¬ 
rectly  attacking  the  police  forensic  science  laboratory  (Geraghty,  2000,  p.  90). 

7  To  make  the  trees  dangerous  to  harvest  in  logging  operations. 

8  See,  for  example,  Foreman  and  Haywood,  1989. 
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less  vulnerable  to  the  loss  of  specific  individuals — can  significantly  increase  the 
group’s  level  of  effectiveness.9’10 

PIRA’s  pursuit  of  anti-aircraft  missiles 
provides  a  ready  example  of  the  damage  that 
the  loss  of  a  particular  person  can  do  to  a  ter¬ 
rorist  group.  In  its  efforts  to  develop  missiles 
that  would  be  effective  against  the  helicopters 
frequently  used  by  security  forces  in  Northern 
Ireland  and  that  it  could  manufacture  itself, 
PIRA  relied  on  an  American  engineer  to  de¬ 
velop  the  needed  technologies.  However,  the  effort  was  compromised  and  the  engi¬ 
neer  was  arrested  before  the  work  was  completed,  so  the  early  results  were  lost 
(Harnden,  2000,  pp.  353-373). 

Not  all  technical  capabilities  are  so  vulnerable.  Gabriel  Cleary,  PIRA  director  of 
engineering  and  “the  man  most  responsible  for  its  range  of  very  effective  homemade 
weaponry — from  mortars  to  sophisticated  long  delay  timing  devices”  (O’Callaghan, 
1999,  p.  305),  was  captured  during  a  failed  arms-importation  attempt  in  1987.  In 
that  case,  the  group’s  technical  knowledge  in  these  areas  was  clearly  held  more 
broadly  than  by  Cleary  alone.  In  the  five  years  Cleary  was  in  prison  (Mac  Dermott, 
1998),  the  organization  continued  to  introduce  new  generations  of  increasingly  effec¬ 
tive  mortars  (Geraghty,  2000).  In  1992,  Hizballah  lost  its  leader  to  an  Israeli  attack. 
Although  the  loss  did  result  in  a  struggle  for  control  of  the  group,  it  did  not  appear  to 
result  in  decreased  capability  (Hirshberg,  1992). 

To  institutionalize  knowledge  that  would  maintain  group  capabilities,  all  of  the 
case  study  groups  carried  out  training  programs  to  distribute  knowledge  among  their 
members.11’12  Training  of  group  members  can  be  carried  out  through  a  variety  of 


"When  supporting  or  carrying 
out  violence,  there  is  always  the 
potential  that  individuals  will  be 
killed  or  apprehended  and  the 
knowledge  and  expertise  they 
carry  will  be  lost  to  their  organi¬ 
zation." 


9  Groups  that  utilize  suicide  terrorism  present  an  extreme  example  of  this  problem.  Since,  by  definition,  the  indi¬ 
viduals  involved  in  suicide  operations  cannot  return  to  the  group  as  repositories  of  knowledge,  the  group  must 
build  an  auxiliary  organizational  structure  to  capture  knowledge  related  to  use  of  the  tactic. 

10  In  his  study  of  left-wing  groups  active  in  Europe,  Pluchinsky  examines  the  ability  of  these  “fighting  communist 
organizations”  to  reconstitute  after  significant  arrests  of  their  leadership.  Such  reconstitution  is  a  key  test  of  the 
effectiveness  of  an  organization’s  knowledge  storage  mechanisms — and  of  whether  those  mechanisms  are  truly 
organizational  in  nature.  Two  of  the  factors  Pluchinsky  cites  as  important  to  this  ability — the  presence  of  active 
members  in  prisons  and  a  dedicated  circle  of  supporters  and  sympathizers — could  be  viewed  as  storage  mecha¬ 
nisms  of  those  organizations  (Pluchinsky,  1992,  pp.  40-42). 

11  Student  notebooks  from  a  training  program  for  Islamic  jihadists  in  Uzbekistan  provide  a  detailed  description  of 
such  a  training  program  (Olcott  and  Babajanov,  2003). 

12  It  should  be  noted  that  training  efforts  and  other  modes  of  institutionalizing  knowledge  within  terrorist  groups 
play  important  roles  in  transmitting  political  and  ideological  information  to  group  members  as  well.  Use  of  group 
publications  to  provide  the  organization’s  interpretation  of  world  events  and  information  on  group  actions  and 
appropriate  member  activities  and  behavior  is  important  for  maintaining  group  cohesion  and  morale.  Many  ter¬ 
rorist  organizations  now  produce  internal  publications,  an  activity  greatly  facilitated  by  the  development  of  the 
Internet. 
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mechanisms:  individuals  can  be  brought  together  in  formal  training  camps  in  a  range 
of  locations  for  direct  instruction;  smaller-scale  instruction  can  be  carried  out  indi¬ 
vidually  or  in  small  groups  in  safe  house  locations;  and  individuals  can  be  trained  vir¬ 
tually  though  transmission  of  information  and  interaction  via  information  technol¬ 
ogy  and  the  Internet.  Even  ELF/ALF,  whose  organizational  model  of  leaderless 
resistance  makes  any  coordinated  or  centralized  actions  very  difficult,  reportedly  uses 
large  group  gatherings  of  environmental  activists  to  undertake  certain  types  of  train¬ 
ing  efforts  (Trujillo,  2005). 

Development  of  manuals,  gaining  access  to  manuals  from  external  sources,  and 
other  types  of  codified  knowledge  are  prominent  strategies  used  by  many  terrorist 
organizations  to  institutionalize  group  capabilities.  The  ability  of  terrorist  groups  to 
exchange  codified  knowledge  sources  with  current  members,  new  and  potential  re¬ 
cruits,  and  sympathizers  rapidly  and  securely  via  the  Internet  has  opened  up  many 
new  ways  for  groups  to  use  such  information.  However,  preparation  of  manuals  in¬ 
volves  obvious  security  risks  to  clandestine  groups.  Terrorist  groups’  efforts  in  this 
area  are  known  only  because  the  manuals  have  been  seized  and  their  contents  com¬ 
promised.  Beyond  simply  accepting  this  risk,  some  terrorist  groups  (more  specifically, 
movements  seeking  to  inspire  terrorist  acts  by  individuals  or  small  groups,  including 
ELF/ALF)  have  simply  made  such  manuals  publicly  available  through  open  publica¬ 
tion  or  dissemination  on  the  Internet.  In  this  way,  the  groups  have  tried  to  maintain 
a  level  of  capability  in  a  network  of  affiliated  groups  that  is  robust  to  the  involvement 
of  many  different,  potentially  quite  inexperienced  members  (Trujillo,  2005). 


CHAPTER  FOUR 

How  Understanding  Terrorist  Group  Learning  Can  Aid 
in  Combating  Terrorism 


Terrorist  groups  present  a  moving  target  that  can  prove  very  difficult  to  hit.  Effec¬ 
tively  aiming  efforts  intended  to  combat  terrorism  hinges  on  being  able  to  anticipate 
how  groups  are  evolving  over  time.  Describing  a  terrorist  group’s  evolution  is  a  first 
step  toward  this  end,  but  understanding  the.  processes  through  which  the  evolution 
takes  place  is  even  more  valuable.  Knowledge  about  the  processes  through  which  ter¬ 
rorist  groups  change  enables  more-educated  anticipation  of  their  future  behavior, 
rather  than  simply  projections  based  on  past  actions.  With  such  an  understanding, 
law  enforcement  and  intelligence  analysts  may  be  able  to  anticipate  where  and  how  a 
terrorist  group  is  likely  to  be  operating  in  the  future. 

The  study  of  organizational  learning  provides  a  window  onto  how  terrorist 
groups  change  and  adapt  and  can  contribute  to  planning  and  operations  for  com¬ 
bating  terrorism  across  three  phases  of  activity  (see  Figure  4.1):1 

•  Detection.  Improved  understanding  of  terrorist  group  learning  can  facilitate  de¬ 
tection  of  their  efforts  to  change. 

•  Anticipation.  Understanding  of  organizational  learning  can  improve  the  ability 
to  anticipate  whether  terrorist  organizations  will  be  successful  in  their  activities. 

•  Action.  Increased  understanding  strengthens  the  capability  to  act  against  terror¬ 
ist  groups  by  illuminating  the  effects  of  group  learning  on  countermeasures  and 
suggesting  novel  counterterrorism  strategies. 


1  Of  course,  it  will  never  be  possible  to  capture  all  the  elements  that  determine  how  terrorist  groups 
evolve.  Groups  will  make  random  or  unpremeditated  changes,  organizational  factors  and  psychology  will  skew 
their  decisionmaking,  and  circumstances  will  influence  them  in  ways  that  cannot  be  foreseen  (McCormick, 
2003). 


27 


28  Aptitude  for  Destruction 


Figure  4.1 

Phases  of  Law  Enforcement  and  Intelligence  Activity  to  Counter 
Terrorist  Group  Efforts  to  Change  and  Adapt 


Detect 
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Detecting  Terrorist  Groups'  Efforts  to  Change 

In  hindsight,  organizational  learning  in  a  terrorist  group  is  usually  easy  to  detect.  It  is 
clear  that  PIRA  learned  in  the  process  of  transforming  its  organizational  structures  to 
address  security  needs  (Jackson,  2005).  It  is  similarly  clear  that  Aum  Shinrikyo 
learned  in  order  to  synthesize  the  sarin  it  used  on  the  Tokyo  subway  (Parachini, 
2005).  But  detecting  a  terrorist  group’s  efforts  to  change  before  the  changes  are  fully 
realized  and  used  in  an  attack  is  much  less  straightforward.  This  is  where  an  under¬ 
standing  of  the  process  of  learning — and  subsequent  change  and  adaptation — can  be 
invaluable.2  As  summarized  in  Figure  4.2,  this  understanding  can  help 

•  Guide  intelligence  collection  by  identifying  the  appropriate  information  to  gather 

•  Contribute  to  intelligence  analysis  by  ensuring  that  critical  data  are  not  over¬ 
looked  and  by  guiding  interpretation  of  intelligence  information 

Equipped  with  these  insights,  analysts  stand  a  much  better  chance  of  recognizing  and 
correctly  interpreting  signals  that  indicate  learning  is  taking  place  while  it  is  still  tak¬ 
ing  place,  rather  than  after  it  has  been  successfully  completed. 

Guidance  for  Intelligence  Collection 

For  the  intelligence  analyst  examining  an  individual  terrorist  organization,  the 
questions,  KIs  the  terrorist  group  learning  and,  if  so,  how?”  are  clearly  important.  To 


2  The  need  to  detect  and  understand  terrorist  organizations’  efforts  to  change  has  been  appreciated  throughout 
the  history  of  terrorist  violence.  Some  indicators  of  terrorist  group  learning  have  therefore  been  available  for  some 
time;  for  example,  law  enforcement  and  intelligence  analysts  have  long  tracked  indicators  of  weapons  procure¬ 
ment  by  terrorist  groups  and  attempts  by  groups  to  gain  access  to  key  technical  capabilities.  However,  in  the  ab¬ 
sence  of  a  clear  and  comprehensive  framework  for  understanding  group  learning,  there  are  no  guarantees  that 
currently  available  indicators  are  sufficient.  It  is  apparent  from  the  analyses  of  our  five  case  study  groups  that  the 
available  indicators  tell  only  part  of  the  story. 
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Figure  4.2 

Understanding  Group  Learning  to  Aid  in  Detection 


An  understanding  of  group  learning  can 

•  Help  guide  intelligence  collection 

•  Contribute  to  intelligence  analysis 

-  Ensure  critical  data  are  not  overlooked 

-  Guide  interpretation  of  intelligence  information 
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answer  them,  the  analyst  must  have  access  to  the  right  information.  However,  there  is 
no  guarantee  that  all  the  information  needed  will  be  collected,  since  simply  asking 
whether  or  not  a  terrorist  group  is  learning  provides  little  guidance  on  the  specific 
information  that  must  be  collected  to  find  an  answer.  To  apply  an  analogy  of  assem¬ 
bling  a  jigsaw  puzzle  to  intelligence  analysis,  while  the  question  may  describe  the  pic¬ 
ture  we  want  to  see  when  the  puzzle  is  finished,  it  does  not  provide  any  guidance 

about  where  we  should  look  to  find  in¬ 
dividual  puzzle  pieces.  In  effect,  the 
question,  “Is  a  terrorist  group  learning?” 
is  not  “actionable”  from  the  perspective 
of  intelligence  collection  because  of  the 
complexity  inherent  in  the  process  of 
organizational  learning. 

In  contrast,  the  individual  components  of  organizational  learning — information 
gathering,  interpretation,  distribution,  and  storage — are  sufficiently  specific  and  dis¬ 
tinct  to  suggest  actionable  questions.  Focusing  on  a  specific  component,  such  as  how 
a  terrorist  group  is  gathering  the  information  needed  to  support  its  learning  effort, 
leads  to  a  range  of  questions  about  the  group’s  knowledge  sources  and  how  it  is  de¬ 
veloping  or  importing  new  information  or  knowledge.3  Because  the  elements  of  the 


"By  breaking  out  the  component  pro¬ 
cesses  required  for  organizational  learn¬ 
ing,  the  framework  enables  one  to  iden¬ 
tify  the  intelligence  that  must  be  col¬ 
lected  to  detect  and  understand  groups' 
efforts  to  learn  and  adapt." 


3  Focusing  intelligence  and  investigation  resources  on  the  specific  components  of  a  terrorist  group’s  organiza¬ 
tional  learning  process  can  produce  significant  successes  in  efforts  to  combat  terrorism.  When  they  were  investi¬ 
gating  changes  in  PIRA’s  advanced  bomb  detonators,  security  forces  in  Northern  Ireland  focused  on  the  nature  of 
the  knowledge  sources  that  the  group  needed  to  develop  the  technologies.  By  tracing  back  through  the  source  of 
specific  electronic  components  of  the  bombs,  the  police  identified  an  American  engineer  who  was  providing  tech- 
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learning  process  suggest  much  more  specific  questions  to  ask,  they  can  help  the  intel¬ 
ligence  collector  locate  individual  pieces  of  the  puzzle  describing  a  terrorist  group’s 
learning  efforts.  By  breaking  out  the  component  processes  required  for  organizational 
learning,  the  framework  enables  one  to  identify  the  intelligence  that  must  be  col¬ 
lected  to  detect  and  understand  groups’  efforts  to  learn  and  adapt  (workshop  discus¬ 
sions;  see  also  Cragin  and  Daly,  2004,  pp.  57-59). 

Because  successful  organizational  learning  requires  a  terrorist  group  to  carry  out 
all  four  of  the  component  processes  described  in  Chapter  Two,  the  analyst  requires 
information  on  all  of  them  to  fully  understand  the  group’s  adaptive  efforts.  When 
pieces  of  the  puzzle  are  missing — when  the  analyst  has  data  on  only  one  or  two  of  the 
individual  processes — it  can  be  impossible  to  fully  understand  terrorist  group  learn¬ 
ing.  Each  of  our  case  studies  revealed  significant  disparities  in  the  amount  of  infor¬ 
mation  available,  at  least  in  the  open  literature,  on  these  four  processes.  For  example, 
while  knowledge-gathering  activities4  have  received  significant  emphasis,  much  less 
attention  has  been  devoted  to  interpretation.  The  available  literature  is  largely  silent 
about  how  the  case  study  terrorist  groups  made  decisions  about  activities,  tactics,  or 
technologies  to  pursue;  how  they  judged  the  success  or  failure  of  their  activities;  and 
how  those  judgments  affected  their  behavior.5  The  processes  of  distribution  and  stor¬ 
age,  where  knowledge  becomes  broadly  available  to  the  group  rather  than  held  only 
by  certain  key  individuals,  have  also  been  underemphasized.6 

This  suggests  that  law  enforcement,  intelligence,  and  other  counterterrorist 
planners  might  encounter  important  “blind  spots”  as  they  attempt  to  analyze  infor¬ 
mation  that  will  enable  them  to  understand  terrorist  group-learning  processes.7  By 
providing  a  systematic  approach  to  defining  what  information  must  be  collected  to 
understand  group  learning,  the  four-part  organizational  learning  model  can  help  en¬ 
sure  that  such  blind  spots  are  addressed.  This  approach  could  require  as  little  effort  as 


nical  assistance  to  the  terrorist  group.  That  same  individual  was  also  helping  the  group  develop  technologies  to 
build  antiaircraft  missiles  whose  deployment  would  have  significantly  changed  the  nature  of  the  conflict.  By  suc¬ 
cessfully  getting  inside  the  terrorist  group’s  learning  processes,  the  police  were  able  to  disrupt  that  effort  before  it 
was  successful  (Harnden,  2000;  Jackson,  2005). 

4  These  activities  include  terrorist  groups’  efforts  to  obtain  weapons  or  recruit  specific  technical  experts. 

5  Though  the  scarcity  of  information  on  such  “internal”  processes  is  not  surprising,  getting  access  to  such  infor¬ 
mation  is  obviously  critical  for  fully  understanding  decisionmaking  by  terrorist  groups  in  their  learning  efforts. 

6  Although  it  was  not  the  primary  focus  of  this  research  effort,  workshop  participants  emphasized  that  under¬ 
standing  the  individual  components  of  the  learning  framework  could  also  enable  development  of  clearer  intelli¬ 
gence-collection  goals,  i.e.,  the  specific  types  of  information  that  are  most  useful  for  detecting  terrorist  group 
activities  and  learning  efforts.  In  an  era  where  intelligence  collection,  particularly  in  the  U.S.  homeland,  relies  on 
information  collected  by  a  wide  range  of  organizations — federal,  state,  local,  and  even  the  private  sec¬ 
tor — standardized  goals  could  make  an  important  contribution  to  improving  the  collection  of  critical  informa¬ 
tion. 

7  This  suggestion  assumes,  to  some  extent,  that  the  information  available  in  the  open  literature  broadly  reflects 
what  is  available  in  classified  sources.  Though  this  will  certainly  not  be  the  case  in  many  areas,  workshop  partici¬ 
pants  indicated  that  it  may  be  generally  appropriate  for  other  areas  or  groups. 
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asking  additional  questions  about  a  terrorist  group’s  efforts  to  learn,  either  during 
routine  intelligence-gathering  efforts  or  during  focused  activities  such  as  interroga¬ 
tion  of  captured  group  members.  To  the  extent  that  terrorist  groups  have  broadly 
established  strategies  and  practices  underlying  their  learning  activities,  the  answers  to 
these  questions  could  provide  durable  insights  into  how  groups  go  about  their  efforts 
to  change. 


Contribution  to  Intelligence  Analysis 

The  model  of  the  organizational  learning 
process  can  also  help  intelligence  and  law 
enforcement  analysts  analyze  information 
that  has  been  collected.  Every  day,  analysts 
receive  a  huge  influx  of  intelligence  data. 
Knowing  what  pieces  of  that  intelligence 
are  most  important  and  how  to  make  sense 
of  new  information  in  the  context  of  what 
is  already  known  about  a  terrorist  group  is  not  always  straightforward.  Analysts  need 
analytical  frameworks  into  which  to  place  acquired  data  and  to  help  make  judgments 
about  the  relative  importance  of  individual  pieces  of  information  (Libicki  and 
Pfleeger,  2004).  Such  frameworks  help  to 


"Analysts  need  analytical  frame¬ 
works  into  which  to  place  acquired 
data. ...  An  understanding  of  terror¬ 
ist  group  learning  provides  an  im¬ 
portant  additional  framework  for 
assessing  intelligence  information." 


•  Ensure  that  critical  data  points  are  not  overlooked 

•  Assist  in  determining  what  intelligence  information  means  and  how  important 
it  is  with  respect  to  overall  group  structures  and  activities 

Many  such  frameworks  are  based,  for  example,  on  assumptions  about  terrorist 
groups’  strategic  goals,  member  psychology,  or  organizational  dynamics  (see,  for  ex¬ 
ample,  McCormick,  2003).  An  understanding  of  terrorist  group  learning  provides  an 
important  additional  framework  for  assessing  intelligence  information. 

Ensuring  That  Critical  Intelligence  Data  Are  Not  Overlooked 

A  model  of  organizational  learning  can  help  single  out  information  related  to  a 
group’s  efforts  to  change,  such  as  how  the  group  gathers  or  stores  information. 
Without  the  framework  such  a  model  provides,  signals  related  to  learning  could  eas¬ 
ily  slip  by  unnoticed.  To  minimize  the  chance  of  this  happening,  characteristic  indi¬ 
cators  of  terrorist  group  learning  activities  could  be  developed  to  point  directly  to 
possible  red  flags.  Detecting  one  of  these  indicators  could  cue  an  analyst  to  signifi¬ 
cant  changes  in  learning  efforts  within  a  known  group  and  could  even  help  to  iden¬ 
tify  early  indicators  of  malevolent  activity  within  a  group  that  has  not  yet  been  iden¬ 
tified.  In  the  PIRA  case,  for  example,  experimentation  during  the  development  of 
several  different  weapons  resulted  in  explosions  in  remote  areas  where  the  group  was 
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conducting  engineering  and  testing  activities 
(Jackson,  2005).  These  were  relatively  un¬ 
ambiguous  signs  that  learning  was  taking 
place.  Aum  Shinrikyo’s  efforts  to  develop 
biological  weapons  led  people  living  near  the 
cult’s  facilities  to  report  strange  smells  and 
emissions  to  environmental  agencies;  these 
were  also  signals  that  the  group  was  learning,  although  they  were  not  appreciated 
as  such  at  the  time  (Parachini,  2005).  Indicators  of  other  types  of  learning-related 
activities  could  similarly  be  applied  to  different  weapons  or  operational  areas. 

A  systematic  understanding  of  terrorist  group  learning  processes,  coupled  with 
an  understanding  of  what  and  how  a  group  needs  to  learn  based  on  the  environment 
in  which  it  operates,8  can  also  help  to  ensure  that  information  on  different  types  of 
group  learning  activities  will  not  be  overlooked.  For  example,  an  analyst  who,  be¬ 
cause  of  concerns  about  major  changes  in  a  group’s  operations,  focuses  only  on  its 
potential  for  discontinuous  learning,  might  miss  important  data  on  continuous  im¬ 
provement  activities.  A  terrorist  group  learning  gradually  over  time  might  draw  on 
different  information  or  knowledge  sources,  use  different  criteria  for  interpretation, 
and  distribute  and  store  knowledge  in  different  ways  than  it  would  if  it  were  aiming 
to  make  a  rapid  shift  in  its  strategies  or  operations.  Moreover,  a  succession  of  incre¬ 
mental  changes  over  time  could  eventually  demonstrate  the  need  for  and  catalyze 
more  discontinuous  change;  if  such  changes  were  not  monitored,  the  subsequent 
transformation  could  come  as  a  surprise. 

Assisting  the  Analyst  in  Determining  What  Intelligence  Data  Mean 

An  analytical  framework  describing  a  terrorist  group’s  organizational  learning  efforts 
can  also  help  law  enforcement  and  intelligence  analysts  understand  the  meaning  of 
information  about  a  terrorist  group.  Such  a  framework  can  provide  both 

•  A  better  context  for  a  group’s  current 
activities  by  looking  back  into  the 
group’s  learning  history 

•  A  more  complete  understanding  of  a 
group’s  operations  by  looking  forward  at 
the  full  learning  implications  of  its  cur¬ 
rent  activities 


"An  analytical  framework  describ¬ 
ing  a  group's  organizational  learning 
efforts  can  also  help  law  enforcement 
and  intelligence  analysts  understand 
the  meaning  of  information  about  a 
terrorist  group." 


"A  systematic  understanding  of 
group  learning  .  .  .  helps  to  ensure 
that  information  on  different  types 
of  group  learning  activities  will  not 
be  overlooked." 


8  An  understanding  of  a  group’s  learning  requirements  for  its  environment  and  desired  change  would  need  to  be 
developed  through  techniques  such  as  red-teaming  and  analysis  of  scenarios  a  group  might  pursue  under  different 
conditions. 
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Looking  back,  the  model  can  make  it  easier  for  analysts  to  interpret  a  terrorist 
group’s  current  learning  activities  in  the  context  of  its  learning  history.  The  way  a 
group  carried  out  the  four  component  processes  in  past  situations  provides  a  context 
for  interpreting  new  information  about  its  activities.  For  example,  PIRA  had  a  long 
history  of  developing  and  manufacturing  new  weapons  systems  such  as  RPGs  and 
mortar  systems.  Therefore,  it  is  not  surprising  that  when  the  group  sought  to  acquire 
antiaircraft  missiles,  it  wanted  to  manufacture  them  internally  as  well  (Harnden, 
2000,  pp.  353-373).  How  PIRA  went  about  learning  in  the  past  suggested  how  it 
might  do  so  in  the  present  and  future. 

Looking  forward,  examining  a  terrorist  group’s  actions  from  the  viewpoint  of 
how  the  group  learns  also  provides  an  alternative  framework  for  understanding  the 
meaning  and  implications  of  its  activities.  A  specific  action,  such  as  recruiting  mem¬ 
bers  in  a  new  area  or  country,  is  given  meaning  by  the  analytical  framework  applied 
when  the  analyst  integrates  it  into  an  overall  picture  of  what  a  terrorist  group  is  do¬ 
ing.  In  a  framework  assessing  the  group’s  strategic  goals,  such  an  act  might  be  inter¬ 
preted  as  an  expansion  of  violent  activities  into  the  new  country.  In  a  framework  as¬ 
sessing  behavior  with  respect  to  the  psychology  and  internal  dynamics  of  an 
organization,  the  same  act  might  be  interpreted  as  reflecting  the  group’s  need  to  ap¬ 
pear  dynamic  to  support  the  morale  of  its  current  membership.  The  meaning  of  an 
act  can  be  interpreted  very  differently,  depending  on  the  nature  of  the  framework 
imposed  upon  it  by  the  analyst.  Although  such  interpretation  is  an  essential  part  of 
the  intelligence  analysis  process,  if  the  frameworks  applied  are  inappropriate  or  in¬ 
complete,  the  analyst  could  seriously  misinterpret  the  implications  of  a  terrorist 
group’s  actions. 

Without  an  analytical  framework  that  captures  a  terrorist  group’s  learning  ac¬ 
tivities,  an  analyst  may  not  be  able  to  appreciate  the  learning  implications  of  the 
group’s  actions.  In  contrast  to  the  above  interpretations  of  recruiting  in  a  new  coun¬ 
try,  from  a  learning  perspective,  such  activity  might  indicate  information  or  knowl¬ 
edge  gathering  aimed  at  building  a  new  capability  or  acquiring  a  new  tactic.  Simi¬ 
larly,  specific  attacks  that  do  not  make  sense  from  a  strategic  perspective  may  be 
perfectly  reasonable  from  a  learning  perspective.  For  example,  if  a  terrorist  group  at¬ 
tacks  a  target  that  seems  to  have  low  priority  or  is  outside  its  usual  areas  of  operation, 
an  analysis  focused  on  strategy  might  conclude  that  the  group  has  been  forced  away 
from  its  favored  targets  or  has  shifted  its  goals.  But  from  a  learning  perspective,  such 
an  attack  could  be  seen  quite  differently,  perhaps  as  an  important  “dress  rehearsal”  to 
help  the  group  learn  what  it  needs  to  do  to  carry  out  a  higher-profile  operation  in  the 
future.9 


9  As  an  example,  Harnden  suggests  that  a  PIRA  attack  on  a  security  forces  base  in  November  1984  using  a  single 
mortar  tube  was  a  rehearsal  staged  to  test  out  a  generation  of  the  technologies  and  to  help  determine  firing  ranges 
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Other  actions  may  also  have  learning  implications  along  with  the  other  benefits 
they  provide  to  a  terrorist  group.  Using  a  learning-focused  model  to  examine  intelli¬ 
gence  can  help  ensure  that  those  implications  are  not  missed.  State  sponsorship  of 
terrorism  is  an  example.  The  potential  contributions  that  state  sponsors  can  make  to 
terrorist  groups  through  activities  such  as  military  training  and  provision  of  weapons, 
sanctuary,  and  intelligence  have  long  been  appreciated  (see,  for  example,  Byman  et 
al.,  2001).  However,  focusing  on  the  full  range  of  potential  impacts  that  such  spon¬ 
sorship  can  have  on  group  learning  provides  a  more  complete  picture  of  these  activi¬ 
ties.  For  example,  Hizballah’s  connections  to  state  sponsorship  had  two  specific 
learning  effects  that,  to  our  knowledge,  are  underappreciated.  First,  Iran’s  provision 
of  intelligence  training  was  important  for  building  Hizballah’s  internal  capacity  to 
learn.  Without  outside  help,  the  group  would  have  had  to  build  that  capability  on  its 
own  and  might  not  have  done  so  effectively.  Second,  beyond  the  direct  benefits  a  ter¬ 
rorist  group  can  receive  from  a  sponsor,  it  is  also  important  that  such  support  can 
“free  up”  group  resources  that  can  then  be  applied  to  other  learning  activities.  This 
effect  is  demonstrated  by  comparing  the  situation  faced  by  Hizballah  with  that  of 
PIRA.  When  Hizballah  encountered  problems  with  its  weapons — e.g.,  jamming  of 
its  radio  detonators — it  simply  obtained  new,  more  effective  weapons  from  its  spon¬ 
sors.  When  PIRA  found  itself  in  a  similar  position,  it  had  to  devote  learning  re¬ 
sources  to  adapting  the  technologies  on  its  own.  By  freeing  up  some  of  the  group’s 
“learning  budget,”  sponsorship  allowed  Hizballah  to  learn  more  effectively  in  other 
areas  (Cragin,  2005). 


Anticipating  the  Outcome  of  Terrorist  Groups'  Efforts  to  Change 

It  is  always  worrisome  when  a  terrorist  group  de¬ 
cides  to  acquire  new  weapons  or  adopt  a  new  tac¬ 
tic.  But  whether  or  not  such  a  decision  actually 
increases  the  threat  the  group  poses  depends  on 
whether  it  can  bring  its  plans  to  fruition.  Threat  is 
not  just  about  what  a  terrorist  group  wants  to  do 
or  tries  to  do;  threat  is  based  on  what  it  can  do  it  successfully.  In  fact,  if  a  group’s  at¬ 
tempt  at  learning  is  unsuccessful,  the  decision  to  learn  something  new  might  actually 
decrease  its  level  of  threat  by  pulling  group  resources  away  from  other  activities  it 


"Threat  is  not  just  about 
what  a  terrorist  group  wants 
to  do  or  tries  to  do;  threat  is 
based  on  what  it  can  do  suc¬ 
cessfully." 


for  the  February  28,  1985,  attack  on  the  police  station  at  Newry.  The  Newry  attack  involved  nine  such  weapons 
and  claimed  the  lives  of  nine  police  officers  (Hamden,  2000,  pp.  232-234). 
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could  carry  out  successfully.10  A  sufficiently  ineffective  attempt  to  learn  could  com¬ 
promise  or  even  injure  or  kill  group  members,  reducing  the  group’s  ability  to  carry 
out  future  attacks. 

To  design  measures  to  combat  terrorism  and  to  effectively  allocate  scarce  intelli¬ 
gence  or  law  enforcement  resources,  it  is  necessary  to  assess  the  threat  a  variety  of  ad¬ 
versaries  pose  as  accurately  as  possible.  The  ability  to  do  so  requires  more  than  in¬ 
formation  about  intent,  since  many  groups  intend  to  do  far  more  than  they  will  ever 
be  able  to  actually  accomplish. 

A  terrorist  group’s  ability  to  learn  determines  its  chance  of  success.  Learning  is 
the  link  between  what  a  group  wants  to  do  and  its  ability  to  bring  together  the  in¬ 
formation  and  resources  to  actually  do  it.  Consequently,  understanding  how  terrorist 
groups  learn  can  directly  contribute  to  the  ability  to  anticipate  whether  their  actions 
will  be  successful  and,  accordingly,  to  determine  the  level  of  threat  they  pose. 

Two  complementary  strategies,  one  focused  on  the  terrorist  group  and  the  other 
on  what  it  is  trying  to  do,  can  help  provide  the  insight  needed  to  better  anticipate  a 
terrorist  group’s  chance  of  success  by 

•  Singling  out  characteristics  of  terrorist  groups  and  their  circumstances  that  are 
useful  in  assessing  whether  they  are  likely  to  be  strong  or  weak  learners 

•  Identifying  what  information,  expertise,  and  other  capabilities  are  required  for  a 
group’s  learning  activities  to  be  successful  so  that  analysts  can  more  effectively 
assess  its  efforts 

The  contribution  of  understanding  organizational  learning  to  the  ability  to  anticipate 
a  group’s  chance  of  being  successful  is  summarized  in  Figure  4.3. 

Identifying  Characteristics  of  Terrorist  Groups  and  Circumstances  That  Affect 
Learning11 

An  understanding  of  the  processes  of  organizational  learning  can  help  identify  the 
characteristics  that  are  important  to  the  success  of  a  terrorist  group’s  efforts  to  adapt 
and  change.  Previous  studies  of  organizational  learning  in  many  types  of  organiza¬ 
tions  have  identified  a  variety  of  characteristics  associated  with  specific  groups’  abili- 


10  Concern  about  chemical,  biological,  radiological,  and  nuclear  weapons  falling  into  the  hands  of  terrorist 
groups  provides  a  ready  example.  Although  pursuit  of  such  weapons  by  any  terrorist  group  should  raise  concerns, 
the  intent  to  acquire  them  may  not  increase — and  could  actually  decrease — the  real  threat  the  group  poses  to 
either  specific  targets  or  the  public  at  large  if  it  cannot  learn  how  to  gain  possession  of  the  weapons  and  to  use 
them  successfully. 

11  Gerwehr  and  Glenn  (2003,  pp.  49-53)  describe  a  complementary  set  of  characteristics  combining  both  group 
propensity  to  change  and  elements  included  in  this  discussion  relating  to  a  group’s  likelihood  of  changing  success¬ 
fully. 
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Figure  4.3 

Understanding  Group  Learning  to  Aid  in  Anticipation 


An  understanding  of  organizational  learning  can  help  to  anticipate  a 
group's  chance  of  changing  successfully  by 


•  Singling  out  characteristics  of  the  group  and  its  circumstances  that 
impact  its  learning  abilities 

•  Identifying  the  types  of  knowledge  required  for  a  group  to  learn 
successfully 
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ties  to  learn  effectively.12  These  characteristics  assist  in  describing  the  nature  of  an  or¬ 
ganization’s  structure  and  interconnections,  membership,  and  activities  and  how  each 
affects  the  ability  of  an  organization  to  learn  effectively. 

The  following  sections  describe  eight  characteristics  (shown  in  Figure  4.4)  that 
are  useful  in  describing  the  nature  of  terrorist  groups  vis-a-vis  their  learning  efforts. 
Because  of  the  number  of  characteristics  that  have  been  identified  as  potentially  in¬ 
fluencing  the  ability  of  groups  to  learn,  these  descriptions  are  comparatively  brief  and 
do  not  comprehensively  examine  all  elements  of  the  characteristics’  effects  on  group 
learning.13  The  examples  presented  are  intended  to  illustrate  the  relevance  of  each 
characteristic  for  assessing  the  learning  capabilities  of  terrorist  organizations.  We  have 
not  attempted  to  calibrate  their  relative  impact  on  specific  groups’  learning  capabili¬ 
ties.14 


12  See,  for  example,  Jackson,  2001;  Trujillo  and  Jackson,  forthcoming,  and  references  therein. 

13  For  example,  studies  of  group  structure  have  assessed  not  only  the  learning  impact  of  the  overall  structure  of 
organizations  (e.g.,  hierarchy,  network,  team  organization,  etc.),  but  also  the  specific  ways  work  teams  within  an 
organization  are  structured  and  how  organizational  design  affects  activities  down  to  the  level  of  interactions  be¬ 
tween  individuals  (see,  for  example,  Hong,  1999).  Completely  exploring  terrorist  group  structure  would  require 
examining  both  the  relevance  and  impact  of  the  full  range  of  variables  on  group  operations.  The  intent  of  this 
study  was  to  provide  a  survey  of  organizational  learning  in  a  range  of  terrorist  groups,  and  such  detailed  examina¬ 
tion  was  beyond  the  scope  of  the  project. 

14  More-quantitative  characterization  of  each  group  trait  and  its  specific  (and  cumulative)  impacts  on  group 
learning  would  require  additional  study  across  a  wider  and  more  broadly  representative  sample  of  terrorist  organi¬ 
zations. 
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Figure  4.4 

Characteristics  That  Affect  Terrorist  Group  Learning  Abilities 


Structure  and  Command  Relationships 

An  organization’s  internal  structure  can  significantly  affect  its  ability  to 
learn.  There  are  many  different  variations  of  possible  group  structures,  from 
classic  hierarchical  “management  trees,”  where  a  group  leader  manages  ac¬ 
tivities  through  multiple  layers  of  organizational  units,  to  hub-and-spoke  networks, 
where  a  central  commander  controls  many  individual  units,  to  less-structured  “lead¬ 
erless  resistance,”  or  “all-channel,”  networks,  where  a  group  lacks  a  central  manage¬ 
ment  function,  but  activities  are  coordinated  through  communications  among  all 
individual  units  (see  Arquilla  and  Ronfeldt,  200 1 ,  for  a  discussion  of  group  structures 
and  terrorist  groups). 

Previous  research  has  identified  a  range  of  potential  impacts  of  group  structure 
on  organizational  learning.  For  example,  requirements  to  transmit  information  and 
knowledge  through  many  layers  of  a  group’s  command  structure  can  impede  learning 
if  information  is  lost  as  it  is  distributed  or  if  communications  can  no  longer  take 
place.15  Within  terrorist  groups,  such  communications  can  also  represent  a  signifi- 


15  A  statement  by  Patrizio  Peci,  a  leader  of  the  Red  Brigades,  illustrates  this  particularly  well:  “When  there  are  few 
in  the  group,  there  are  even  discussions  on  how  to  move  about  in  the  street,  what  sort  of  clothes  are  best  used. 
The  mistakes  leading  to  the  capture  of  comrades  are  studied,  there  is  much  discussion.  When  the  organization 
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cant  security  risk.  These  tradeoffs  emphasize  the  dual  impacts  of  a  group’s  size  on 
learning  capability:  While  a  larger  number  of  individuals  can  increase  capability,  it 
can  also  increase  the  need  for  management  structures  and  processes.  The  nature  of  a 
terrorist  group’s  structure  can  also  influence  the  vulnerability  of  the  organization’s 
memory  and  stored  knowledge  to  deterioration,  depending  on  how  compartmental¬ 
ized  particular  types  of  knowledge  are  in  different  components  of  the  group  (Carley, 
1992;  see  also  Hong,  1999).  The  difficulties  of  effective  communications  and  failures 
in  organizational  memory  can  both  hinder  a  group’s  ability  to  learn. 

The  security  vulnerabilities  and  inefficiencies  in  communications  inherent  in 
many  group  structures  have  led  some  terrorist  groups  to  shift  their  structural  models 
to  improve  their  learning  performance.  PIRA  and  Hizballah  created  specialized  in¬ 
ternal  units  that  focused  on  particular  activities  such  as  intelligence,  specific  attack 
forms,  and  logistical  functions.  This  structural  shift  increased  the  terrorist  groups’ 
effectiveness  by  focusing  learning  efforts  within  the  specialized  functions.  Grouping 
similar  specialists  together  allows  deeper  learning  and  sharing  of  expertise,  while 
minimizing  the  need  to  distribute  information  or  knowledge  broadly. 16 

The  level  of  control  and  command  authority  exerted  through  the  relationships 
among  different  parts  of  an  organization  can  also  significantly  affect  ability  to  learn. 
Our  five  case  studies  provide  a  number  of  examples  of  how  command  authority  exer¬ 
cised  through  groups’  management  structures  can  affect  this  ability.  Combinations  of 
group  structures  and  command  relationships  that  allow  individual  units  significant 
autonomy  provide  considerable  opportunities  to  experiment  and  innovate  at  the  tac¬ 
tical  level.  In  PIRA,  for  example,  even  though  a  centralized  council  commanded  the 
group,  the  council  reportedly  did  not  fully  control  all  of  the  activities  of  individual 
cells  (Bell,  1998b,  pp.  468^469,  591;  Collins  and  McGovern,  1998,  p.  220;  Drake, 
1998,  p.  29;  O’Doherty,  1993).  This  allowed  different  parts  of  PIRA  to  attempt  new 
operations  ranging  from  attacking  and  sinking  British  coal  ships  at  sea  to  attempting 
to  bomb  security  force  targets  from  the  air  (Jackson,  2005).  Such  freedom  can  help 
overall  organizational  learning,  as  the  group  can  choose  among  the  experiments  and 
repeat  those  it  deems  useful. 

On  the  other  hand,  autonomy  at  the  cell  level  can  make  it  much  more  difficult 
for  the  group  to  implement  a  coherent  overall  strategy.  For  example,  at  times,  when 
the  overall  leadership  of  PIRA  was  involved  in  negotiations  or  other  political  activ¬ 
ity  aimed  at  advancing  the  group’s  agenda  by  means  other  than  violence,  individ¬ 
ual  units  carried  out  attacks,  effectively  sabotaging  the  efforts  (Bell,  1998b,  pp. 


becomes  larger,  however,  there  is  less  discussion.  It  seems  paradoxical,  but  it  is  so.  Dealing  with  a  compartmen¬ 
talized  organization,  global  discussion  is  almost  impossible  and,  as  a  result,  everyone  ends  up  doing  more  or  less 
what  he  wants,  even  because  it  becomes  more  difficult  to  reach  the  senior  leader”  (Peci,  1983,  p.  86).  We  thank 
Dennis  Pluchinsky  for  bringing  this  example  to  our  attention. 

16  The  Revolutionary  Armed  Forces  of  Colombia  (FARC)  (Ortiz,  2002)  and  the  Tamil  Tigers  (Chalk,  2000) 
have  also  reportedly  adopted  this  strategy. 
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468-46 9). 17  Granting  cells  autonomy  can  also  undermine  a  group’s  ability  to  learn  at 
the  strategic  level,  i.e.,  to  shape  the  totality  of  its  operations  and  activities  to  improve 
its  chances  of  achieving  broader  group  goals.  Strategic  learning  requires  that  a  group 
make  changes  in  the  types  of  operations  it  pursues  or  the  ways  it  pursues  them  and 
then  determine  which  changes  are  beneficial  and  which  hurt  the  group’s  interests.  If 
individual  units  do  not  respond  to  central  coordination,  it  is  difficult  or  impossible  to 
gather  the  information  needed  to  improve  a  group’s  strategy.  In  contrast,  terrorist 
groups  with  much  tighter  command  authority  and  centralized  coordination,  such  as 
Hizballah  (Cragin,  2005),  are  better  able  to  shape  their  overall  activities  and  engage 
in  strategic  learning.18 

When  considering  a  terrorist  group’s  learning  capabilities,  analysts  must  deter¬ 
mine  if  the  group’s  structure  and  command  relationships  will  make  it  easier  or  more 
difficult  to  bring  together  the  needed  resources  and  knowledge.  For  activities  that 
rely  on  bringing  together  significant  tacit  knowledge,  group  structures  must  support 
the  sharing  of  that  knowledge  by  the  right  individuals.  The  formation  of  specialized 
units  that  collocate  specialists  is  one  strategy  that  terrorist  groups  have  utilized.  If 
mostly  explicit  knowledge  is  needed  for  an  action,  such  linkages  are  less  critical. 
Similarly,  terrorist  groups  seeking  to  execute  complex  strategies  that  require  coordi¬ 
nation  of  many  elements  to  achieve  the  needed  learning  must  have  stronger  and  more 
centralized  command  than  groups  whose  focus  is  on  making  improvements  at  the 
tactical  level.  Any  mismatch  between  the  requirements  of  what  a  terrorist  group  is 
attempting  and  the  structures  it  has  to  support  those  efforts  reduces  the  chance  of 
success. 

The  Nature  of  Group  Communications  Mechanisms 

Whether  a  group  has  strong  or  weak  communications  capabilities  can 
significantly  affect  the  likelihood  of  its  success  in  a  learning  effort.  Even 
if  a  group  has  all  the  knowledge  and  expertise  it  needs  to  carry  out  a  new 
type  of  attack,  its  attempt  will  fail  if  the  members  who  have  that  knowledge  cannot 
communicate  reliably.  Similarly,  if  key  knowledge  cannot  be  communicated  for 
interpretation  and  decisionmaking,  a  group  may  miss  important  opportunities  or 
make  critical  errors  (Bell,  1993,  pp.  5-6).  Furthermore,  effective  communication 
among  group  members  is  critical  in  order  for  knowledge  to  make  the  transition 
from  individual  knowledge  to  truly  organizational  knowledge.  As  a  result,  in 
addition  to  influencing  the  success  of  a  particular  learning  effort,  communications 


17  Examples  of  similar  situations  have  been  cited  with  respect  to  the  Front  for  the  Liberation  of  Quebec  and  the 
Palestinian  Liberation  Organization  (PLO)  (Tucker,  2001,  and  references  therein). 

18  A  recent  analysis  of  al  Qaeda  specifically  mentions  the  difficulty  of  implementing  coherent  and  effective  ter¬ 
rorist  group  strategies  in  networked  organizations  without  sufficient  control  mechanisms  (McAllister,  2004). 
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capabilities  strongly  influence  the  robustness  of  the  overall  capabilities  of  an  orga¬ 
nization. 

A  group’s  ability  to  distribute  information  and  knowledge  for  interpretation  and 
use  depends  on  both  available  technological  modes  of  communications — how  it 
communicates — and  interpersonal  networks  among  group  members — who  chooses 
to  communicate  with  whom  (Beeby  and  Booth,  2000).  In  terrorist  groups,  security 
concerns  impose  significant  additional  limits  on  communications,  since  compromise 
of  communications  paths  can  provide  major  opportunities  for  security  forces  to  act 
against  a  group. 

Our  case  studies  provide  examples  of  group  communications  practices  ranging 
from  JI’s  transfer  of  simple  tactical  information  via  cell  phones  (Baker,  2005)  to 
many  groups’  extensive  training  efforts  to  communicate  practical,  ideological,  and 
organizational  knowledge  to  new  and  existing  group  members.19  The  ability  to  train 
and  thereby  communicate  critical  explicit  and  tacit  knowledge  to  members  was  a  key 
component  of  all  the  organizations’  efforts  to  build  robust  capabilities.  Other  exam¬ 
ples  of  communications  mechanisms  that  supported  organizational  learning  efforts 
include  maintenance  of  formal  “doctrine  development”  processes  by  Hizballah 
(Cragin,  2005)  and  the  broad  use  of  training  manuals  by  many  of  the  case  study  or¬ 
ganizations.  By  capturing  critical  knowledge,  such  manuals  make  it  easy  to  transfer 
knowledge  among  the  entire  organization. 

Effective  transfer  of  knowledge  among  group  members  requires  the  use  of 
communications  modes  that  are  appropriate  for  the  type  of  information  being  trans¬ 
ferred.  Explicit  and  tacit  knowledge  require  different  mechanisms  of  communica¬ 
tions.  Tacit  knowledge  relies  much  more  on  direct  face-to-face  interaction  (reviewed 
in  Gertler,  2001),  so  if  security  or  other  pressures  force  a  group  to  limit  such  interac¬ 
tion,  learning  efforts  that  depend  on  the  transfer  of  tacit  knowledge  will  suffer. 

As  an  example  of  this  tradeoff,  security  concerns  caused  PIRA  to  shift  from  a 
relatively  open  structure,  where  many  members  interacted  frequently,  to  a  compart¬ 
mentalized,  cellular  one.  Although  the  cellular  structure  was  supposed  to  significantly 
restrict  communications  among  members,  the  transition  was  described  as  “incom¬ 
plete” — connections  and  exchange  of  individuals  among  cells  persisted  because  some 
types  of  knowledge  still  had  to  be  transferred  (Jackson,  2005). 

The  nature  of  a  terrorist  group’s  available  communications  mechanisms  can 
provide  some  insight  into  the  likelihood  that  specific  learning  efforts  will  be  success¬ 
ful.  Strong  communications  links,  such  as  the  ability  to  train  extensively,  increase  the 
chance  that  a  group  can  effectively  share  the  tacit  and  explicit  knowledge  needed  to 
build  robust  group  capabilities.  However,  in  thinking  about  the  potential  impact  a 
terrorist  group’s  communications  can  have  on  its  learning  efforts,  the  analyst  must 


19  Many  of  these  communications  mechanisms  require  a  secure  territorial  haven.  This  is  discussed  briefly  in  the 
section  on  terrorist  groups’  operational  environments. 
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remain  cognizant  of  what  the  group  is  trying  to  accomplish.  Though  the  lack  of  face- 
to-face  communications  capabilities  could  be  a  significant  impediment  to  efforts  re¬ 
lying  on  tacit  knowledge,  other  learning  efforts  could  be  affected  less. 

Absorptive  Capacity  for  New  Knowledge 

/'T'n.  Even  if  a  group  acquires  useful  knowledge,  it  must  be  able  to  absorb  and 
apply  it  or  it  will  not  learn  and  its  operations  will  not  benefit.  A  group’s 
ability  to  interpret  new  knowledge  and  put  it  to  use  is  largely  determined  by 
the  relationship  between  the  new  knowledge  and  what  the  group  and  its  members 
already  know  (Hall  and  Khan,  2003).  For  example,  technologies  that  are  similar  to 
those  already  in  use  by  the  organization  are  easier  to  absorb  (Gopalakrishnan  and 
Bierly,  2001;  Mowery  et  al.,  1996;  Robinson  et  ah,  2003)  because  they  require  the 
least  changes.20 

Groups  that  lack  the  knowledge  necessary  to  absorb  a  desired  technology  must 
develop  that  knowledge  to  succeed.  This  additional  learning  requirement  can  slow  a 
group’s  effective  use  of  the  new  technology.  When  PIRA  made  its  initial  attempts  to 
use  RPGs,  it  lacked  the  necessary  knowledge  and  experience,  and  as  a  result,  its  early 
attempts  were  largely  ineffective  (Bell,  1987,  pp.  53-54).  Subsequently,  the  group 
built  up  the  knowledge  needed  and  put  the  weapons  to  more  effective  use  (Jackson, 
2005).  When  Aum  decided  to  produce  and  use  biological  weapons,  an  activity  dra¬ 
matically  different  from  anything  the  group  had  done  previously,  its  lack  of  the 
knowledge  needed  to  absorb  the  technologies  resulted  in  multiple  failures  (Parachini, 

2005).21 

Because  of  the  impact  that  absorptive  capacity  can  have  on  a  terrorist  group’s 
chances  of  learning  successfully,  information  on  the  group’s  previous  learning  efforts 
and  available  knowledge — the  primary  determinants  of  that  capacity — is  important 
for  judging  the  likely  outcomes  of  future  efforts.  To  the  extent  that  analysts  can  build 
an  understanding  of  a  target  group’s  ability  to  absorb  related  knowledge,  their  judg¬ 
ments  about  future  innovation  will  benefit.  For  example,  understanding  PIRA’s  ef¬ 
forts  to  develop  new  generations  of  machined  weapons  is  critical  for  evaluating  its 
later  efforts  to  design  and  manufacture  antiaircraft  missiles  (Jackson,  2005).  Though 
missiles  are  significantly  different  from  RPGs  or  mortars,  developing  them  would 
draw  on  many  of  the  skills  the  group  had  developed  in  its  earlier  weapons  manufac¬ 
turing  efforts  and  would  therefore  increase  the  effort’s  chances  of  success.  In  contrast, 


20  Groups  that  have  done  similar  things  in  the  past  will  already  possess  some  of  the  tacit  knowledge  needed  to 
succeed  at  the  new  activity. 

21  To  minimize  the  impacts  of  absorptive-capacity  problems,  terrorist  groups  can  use  elite  and  specialized  units  to 
introduce  and  validate  new  technologies.  By  building  expert  units  within  the  organization,  a  terrorist  group  can 
improve  its  ability  to  absorb  new  technologies  that  are  related  to  the  units’  areas  of  expertise.  Hizballah  and  PIRA, 
as  well  as  the  LTTE  (Chalk,  2000)  and  FARC  (Ortiz,  2002),  built  such  units  within  their  organizations  and  gave 
them  prominent  roles  in  learning  activities  in  their  areas  of  expertise. 
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Aum  Shinrikyo  devoted  much  of  its  learning  efforts  to  unconventional  weapons,  de¬ 
veloping  capabilities  in  technologies  related  to  chemical  and  biological  agents.  As  a 
result,  any  group  effort  to  utilize  the  plans  the  group  had  acquired  for  manufacturing 
Russian  AK-74  rifles  would  have  had  little  relevant  past  experience  to  support  it 
(Parachini,  2005).  An  analyst  could  therefore  safely  conclude  that  it  would  require 
additional  learning  efforts  on  Aum’s  part  if  the  effort  were  to  be  carried  out  success¬ 
fully. 

Stability  of  Membership 

®A  key  component  of  all  organizations’  memories  is  the  expertise  and  knowl¬ 
edge  held  in  the  minds  of  their  members.  Loss  of  members  who  hold 
key  knowledge  can  be  a  major  blow  to  an  organization’s  ability  to  learn. 
Furthermore,  continuous  improvement  efforts,  where  individual  members  or  units  of 
an  organization  accumulate  knowledge  or  skill  over  time,  are  critical  for  building  ex¬ 
pertise.  Groups  whose  membership  is  stable  have  greater  opportunities  to  build  up 
expertise  gradually  and  less  chance  of  losing  knowledge  through  the  departure  of 
group  members  (Carley,  1992;  Edmonson  et  ah,  2003;  Kim,  1993;  Lipshitz  et  ah, 
2002). 22 

One  of  PIRA’s  most  stable  units  was  a  cell  based  in  South  Armagh,  a  region  on 
the  border  between  Northern  Ireland  and  the  Irish  Republic.  Its  members  operated 
together  for  many  years,  enabling  it  to  build  up  a  level  of  capability  and  military  pre¬ 
cision  that  set  it  apart  from  the  rest  of  the  terrorist  organization.  The  unit  was  more 
successful  in  carrying  out  operations  safely — “there  were  fewer  mistakes  and  therefore 
fewer  arrests  in  South  Armagh  than  in  any  other  [PIRA]  Brigade  area”  (Harnden, 
2000,  p.  46).  The  unit’s  expertise  also  provided  PIRA  with  a  key  resource  for  learn¬ 
ing:  The  South  Armagh  Brigade  frequently  introduced  new  weapons  and  tactics,  and 
it  played  key  roles  in  supporting  high-profile  PIRA  operations  (Harnden,  2000,  p. 
19).  Similarly,  because  of  the  long  tenure  of  its  members,  the  inner  circle  of  Hizbal- 
lah’s  original  command  structure,  which  had  knowledge  and  skills  built  up  over  time, 
was  drawn  on  for  high-profile  attacks  that  had  significant  learning  requirements 
(Cragin,  2005).  The  long  operational  experience  of  individual  JI  and  PIRA  bomb- 
makers  (although  not  necessarily  the  groups’  members  in  general)  was  vital  to  the 
terrorist  groups’  abilities  to  improve  their  explosive  devices  incrementally  over  time 
(“Azahari’s  Tracks,”  2003;  Glover,  1978). 

Assessing  the  impact  of  terrorist  group  stability  on  group  learning  is  potentially 
particularly  difficult,  since  the  intelligence  necessary  to  do  so  will  likely  be  harder  to 


22  As  with  many  of  the  other  characteristics  described  in  this  chapter,  the  length  of  terrorist  group  members’  op¬ 
erational  careers  is  a  potential  contributor  to  improved  group  learning  capability,  but  it  does  not  immediately  and 
positively  follow  that  an  increase  in  membership  stability  will  result  in  more-effective  learning.  Details  matter.  For 
example,  if  members  extend  their  longevity  by  going  underground  and  do  not  participate  in  activities  related  to 
group  functions  for  many  years,  the  group’s  learning  capability  is  unlikely  to  increase. 
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obtain.  However,  any  information  that  can  be  collected  on  individual  terrorists’  ten¬ 
ures  and  experiences  or  similar  data  on  particular  units  within  an  organization  could 
yield  important  insights  for  assessing  terrorist  group  efforts.23 


The  Nature  of  the  Group's  Operational  Environment 

The  environment  in  which  any  given  group  operates  is  perhaps  the  domi¬ 
nant  factor  influencing  both  the  group’s  incentive  and  its  capacity  to  learn. 
The  environment  defines  the  group’s  operational  opportunities  and  the 
types  of  learning  it  might  pursue  to  take  advantage  of  them,  influences  the  types  of 
investments  it  makes  in  learning,  and  governs  its  potential  to  learn  (Dodgson,  1993; 
Garvin,  1993). 

A  terrorist  group’s  environment  helps  shape  its  learning  goals,  which  in  turn  de¬ 
termine  the  kind  of  learning  the  group  will  need  to  achieve  them:  Certain  environ¬ 
ments  and  goals  may  call  for  continuous  improvement  efforts,  while  others  might 
favor  major  changes.  Groups  that  have  waged  ongoing  terrorist-insurgent  campaigns 
in  comparatively  stable  theaters  of  operation,  such  as  PIRA  and  Hizballah,  carry  out 
many  more  individual  operations  than  groups  that  engage  in  terrorism  more  episodi¬ 
cally,  such  as  JI  or  Aum.  A  higher  operational  tempo  provides  more  opportunities  for 
incremental  learning  activities,  such  as  refining  marksmanship  and  building  better 
explosives,  potentially  making  highly  active  terrorist  groups  much  better  at  continu¬ 
ous  improvement. 

Efforts  to  combat  terrorism  are  major  sources  of  uncertainty  and  threat  in  a  ter¬ 
rorist  group’s  environment.  As  a  result,  a  group’s  ability  to  insulate  itself  from  those 
pressures  and  gain  the  time  and  opportunity  to  evaluate  new  knowledge,  modify 
strategies,  and  carry  out  other  learning  activities  is  a  key  determinant  of  its  ability  to 
learn  effectively.  In  our  case  studies,  there  appears  to  be  a  break  point  in  learning  be¬ 
tween  terrorist  groups  that  were  able  to  gain  sufficient  safe  haven24  to  be  able  to  ex¬ 
periment  and  innovate  away  from  direct  pressure  and  those  that  could  not.25  PIRA, 
Hizballah,  and  Aum  each  had  the  ability  to  make  that  space — either  literally  or  figu¬ 
ratively,  on  their  own  or  with  the  help  of  sympathetic  states — and  as  a  result,  they 
increased  their  ability  to  learn. 

Environmental  characteristics  are  readily  identifiable  influences  on  a  terrorist 
group’s  potential  to  succeed  in  a  specific  learning  activity.  Groups’  operational  tempo 
and  experience  with  continuous  improvement  efforts  can  provide  a  clue  to  potential 
outcomes.  Across  all  terrorist  groups,  the  importance  of  safe  havens  for  learning  is 


23  As  both  the  PIRA  and  JI  cases  suggest,  these  data  can  sometimes  be  inferred  from  the  analysis  of  specific  indi¬ 
viduals’  products — e.g.,  identifying  the  tenure  of  the  bombmaker  through  the  signature  of  his  or  her  workman¬ 
ship  in  the  bomb. 

24  See  Byman  et  al.,  2001,  and  Cragin  and  Daly,  2004,  for  further  discussion  of  safe  havens. 

25  See  Takeyh  and  Gvosdev,  2002,  for  discussion  of  the  role  of  safe  havens  in  multinational  terrorist  networks. 
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clear.  Without  the  safety  needed  to  experiment  and  test  new  ideas  and  operations,  a 
group’s  chances  of  implementing  them  successfully  are  significantly  reduced. 


Connections  to  Knowledge  Sources 


Having  access  to  the  knowledge  needed  to  carry  out  desired  activities  is  es- 
^(—4  sential  to  a  group’s  ability  to  learn.  Connections  to  appropriate  knowledge 
sources  can  increase  the  chance  that  groups  will  be  able  to  locate  and  use 
necessary  information  and  knowledge  (Hardy  et  al.,  2003). 

To  gain  access  to  explicit  knowledge  required  for  group  learning  efforts — i.e., 
plans,  technologies,  weapons — terrorist  groups  must  be  connected  to  the  right 
sources.  For  example,  obtaining  weapons  and  armaments  is  a  key  goal  of  most  ter¬ 
rorist  groups,  so  they  need  to  know  where  and  how  to  get  them.  PIRA  was  initially 
limited  in  its  ability  to  acquire  weapons  by  its  lack  of  knowledge  of  how  to  interact 
with  and  draw  on  the  international  arms  market,  a  shortfall  only  partially  made  up 
for  by  arms  provided  by  Libya  and  sympathetic  sources  in  the  United  States.  To 
make  up  for  its  limited  connections  to  arms  sources,  PIRA  had  to  undertake  the 
learning  efforts  required  to  manufacture  its  own  weapons  (Bell,  1998b,  p.  373). 
PIRA’s  lack  of  connections  to  sources  of  explicit  knowledge  therefore  delayed  its  ac¬ 
quisition  of  particular  tactics  and  technologies.  In  contrast,  to  procure  arms,  even 
beyond  those  provided  by  its  state  sponsors  in  Iran  and  Syria,  Hizballah  built  up  an 
extensive  international  network,  including  activities  in  Colombia  (Cragin  and 
Hoffman,  2003). 

Sources  such  as  the  Internet  and  information  in  the  open  literature  can  provide 
access  to  a  wide  variety  of  explicit  knowledge,  including  information  supporting  tar¬ 
get  selection  and  attack  planning,  technical  information  relevant  to  weapons  and  op¬ 
erations,  and  assistance  in  connecting  to  sources  of  needed  supplies  or  other  materiel. 

For  many  group  learning  efforts,  organizations  must  also  have  access  to  people 
and  organizations  that  possess  necessary  tacit  knowledge.  Otherwise,  they  must  de¬ 
velop  the  knowledge  for  themselves,  which  can  either  slow  or  defeat  their  learning 
efforts.  PIRA,  Hizballah,  JI,  and  Aum  Shinrikyo  all  effectively  connected  with  out¬ 
side  experts  (from  state  sponsors  and  other  sources)  to  obtain  desired  knowledge  and 
capabilities.  They  also  interacted  with  other  terrorist  groups  to  obtain  knowledge. 
For  example,  JI’s  ties  with  al  Qaeda  provided  opportunities  for  learning  about  explo¬ 
sives  (Baker,  2005;  Arquilla  and  Ronfeldt,  2001). 

A  terrorist  group’s  connections  to  knowledge  sources  are  a  key  element  for  as¬ 
sessing  terrorist  group  learning  capabilities  and  an  organization’s  likelihood  of  success 
in  carrying  out  ongoing  attempts  to  learn.  Intelligence  training  from  states  and  access 
to  individuals  with  operational  military  experience  were  particularly  critical  for  sev¬ 
eral  of  the  terrorist  organizations  in  our  case  studies.  Terrorist  groups  that  have 
strong  connections  to  the  right  sources  of  knowledge  are  more  likely  to  be  successful. 
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Resources  Devoted  to  Learning 

Although  learning  can  occur  as  an  incidental  product  of  routine  operations, 
groups  frequently  must  devote  resources  and  individuals  to  achieve  it. 
While  many  organizations  hesitate  to  commit  resources  to  anything  but 
“direct  operations,”  those  willing  to  devote  human  and  capital  resources  to  learning 
have  a  greater  chance  that  a  learning  effort  will  be  successful.26  Aum  Shinrikyo  and 
PIRA  conducted  ongoing  “research  and  development”  aimed  specifically  at  learning 
to  support  their  efforts  to  develop  new  weapons  and  acquire  novel  tactics.27 

In  assessing  a  terrorist  group’s  potential  for  success,  the  analyst  must  consider 
the  type  and  level  of  resources  the  group  has  committed  to  the  learning  effort.  It  is 
important  to  note,  however,  that  simply  committing  resources  does  not  guarantee 
success.  Aum  Shinrikyo  devoted  very  significant  resources  to  its  biological  and 
chemical  weapons  activities  but  was  ultimately  unsuccessful  (Leitenberg,  1999; 
Rosenau,  2001). 28 


Group  Culture 

A  group’s  culture  directly  affects  its  ability  to  learn.  Learning  efforts  are  in¬ 
fluenced  by  systems  of  reward  and  reprimand,  tolerance  for  risk,  the  value 
placed  on  novelty,  and  the  level  of  freedom  members  have  to  act  independ¬ 
ently  (Lipshitz  et  al.,  2002).  Cultural  norms  that  constrain  individuals’  roles  within 
the  group  or  make  it  difficult  to  spread  knowledge  gained  by  individuals  to  the  rest 
of  the  group  can  hinder  group  efforts  to  learn  (Romme  and  Dillen,  1997) 29  Two 
factors  in  particular  contribute  to  a  pro-learning  culture  within  organizations:  group 
leadership  that  is  positive  toward  learning  and  group  tolerance  for  risk. 

The  words  and  actions  of  a  group’s  leaders  define  the  value  structure  and  cul¬ 
ture  of  the  group.  The  commitment  of  group  leaders  to  learning  activities — includ¬ 
ing  how  they  reward  individuals  for  participating  in  learning  activities,  whether  they 
devote  resources  to  innovative  efforts,  how  they  react  to  failed  attempts  at  innova¬ 
tion,  and  whether  they  themselves  encourage  the  group  to  adopt  new  tactics  and  op- 


26  Emphasizing  its  commitment  to  specific  types  of  learning  activities,  LTTE  has  reportedly  invested  up  to  40 
percent  of  its  war  budget  in  intelligence  gathering  (Gunaratna,  2001a). 

27  Well-described  counterexamples  are  somewhat  elusive,  given  the  lesser  incentive  to  devote  detailed  analytical 
attention  to  lower-profile  or  apparently  less-threatening  terrorist  groups.  Such  groups  were  also  not  included  in 
our  case  studies.  Examples  of  organizations  that  do  not  devote  significant  resources  to  tactical  and  operational 
learning — and,  as  a  result,  pose  threats  of  a  significandy  different  nature — include  racially  motivated  radical 
groups  whose  violent  activities  are  frequendy  opportunistic  (see,  for  example,  Kaplan,  1995;  Willems,  1995). 

28  This  failure  was  addressed  in  the  section  on  absorptive  capacity. 

29  Because  of  the  focus  on  learning  in  our  case  studies,  we  did  not  examine  terrorist  groups  whose  culture  was 
significantly  negative  toward  learning. 
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tions — determines  the  group  culture  with  respect  to  learning.30  Groups  whose  leaders 
do  not  support  learning  will  be  less  likely  to  innovate  successfully. 

The  effect  of  the  leadership  on  the  learning  culture  of  a  group  is  not  necessarily 
uniform  across  a  terrorist  organization:  Differences  among  PIRA  units,  some  having 
leadership  that  promoted  innovation  and  some  having  leadership  that  did  not,  con¬ 
tributed  to  some  units  being  better  at  learning  than  others  (Harnden,  2000; 
O’Callaghan,  1999,  pp.  71,  101-102).  Leaders  who  promote  learning  value  their 
group  members  learning  from  past  activities,  whether  those  activities  succeeded  or 
failed.31'32  As  noted  earlier,  PIRA  (Collins  and  McGovern,  1998;  O’Doherty,  1993) 
and  JI  (International  Crisis  Group,  2003,  p.  17)  both  used  “after-action”  reviews  of 
activities  and  operations  to  learn  from  past  experience  and  improve  over  time.  The 
decision  on  the  part  of  the  groups’  leadership  to  carry  out  such  processes  reinforces 
the  value  the  group  places  on  learning  and  encourages  members  to  pursue  it. 

Whether  a  terrorist  group  can  learn  effectively  also  depends  on  how  tolerant  it  is 
of  risk.  If  a  group’s  leadership  is  willing  to  accept  failed  attempts  at  innovation, 
members  will  be  more  likely  to  continue  to  experiment  and  explore  new  tactics  and 
technologies.  PIRA  exemplifies  this  sort  of  permissive  environment:  Even  when 
units’  experiments  were  damaging  to  the  group,  the  central  leadership  was  reportedly 
more  likely  to  justify  the  actions  than  to  punish  the  individuals  involved  (Drake, 
1998,  p.  29).  While  this  could  have  undermined  the  group’s  overall  strategic  pro¬ 
gress,  it  preserved  a  culture  where  individuals  were  willing  to  try  new  things  that  were 
potentially  useful.  In  contrast,  the  members  of  a  terrorist  group  that  is  risk  averse  and 
punishes  individuals  when  experiments  fail  will  be  much  less  likely  to  try  new  things 
in  the  future. 

To  the  extent  possible,  an  analyst  should  bring  any  available  information  about 
a  terrorist  group’s  culture  to  bear  in  assessing  ongoing  learning  efforts.  In  groups 
where  innovation  is  rewarded  and  supported  by  group  leaders,  individuals  are  more 
likely  to  take  the  risks  needed  to  try  new  things  and  more  likely  to  innovate  success¬ 
fully.  In  contrast,  groups  with  a  conservative  approach  to  change  or  a  culture  that  is 
unforgiving  of  failure  are  less  likely  to  learn  successfully. 


30  It  should  be  noted  that  the  relevant  leadership  with  respect  to  terrorist  group  learning  activities  may  or  may 
not  be  the  same  as  the  political  or  hierarchical  leadership  of  the  group.  For  example,  key  members  of  the  “learning 
leadership”  might  include  technical  people  within  specialized  units  who  might  be  at  least  as  important  as  the 
command  structure  for  influencing  group  culture  for  learning. 

31  The  Tamil  Tigers  are  an  example  of  a  terrorist  group  whose  leadership  strongly  values  learning  and  therefore 
encourages  it  (Gunaratna,  1997). 

32  In  contrast,  leaders  focused  on  maintaining  an  appearance  of  success  may  be  unwilling  to  examine  or  even  dis¬ 
cuss  past  actions  that  were  not  viewed  as  successful. 


How  Understanding  Terrorist  Group  Learning  Can  Aid  in  Combating  Terrorism  47 


Identifying  the  Knowledge  Required  for  a  Group  to  Learn  Successfully 

;  Adopting  a  new  tactic  or  weapon  successfully 

"Learning  will  be  successful  only  d  r  ires  that  a  terrorist  group 

if  the  group  can  bring  together  the  ,  ;  ,  ,  , 

right  combination  of  knowledge  to  ac£luire  botb  ,exPllclt  ta<f  knowledge, 

accomplish  its  goals."  Learning  will  be  successful  only  if  the  group 

— ____ ___ ^ can  bring  together  the  right  combination  of 

knowledge  to  accomplish  its  goals.  Assess¬ 
ment  of  whether  a  terrorist  group’s  learning  efforts  will  be  successful  therefore  re¬ 
quires,  first,  articulation  of  what  the  group  is  trying  to  do  and  then  identification  of 
the  particular  combinations  of  explicit  and  tacit  knowledge  needed  to  do  it  success¬ 
fully.33  After  identifying  the  different  routes  a  group  could  pursue,  the  analyst  must 
determine  whether  it  is  learning  in  a  way  that  will  enable  it  to  achieve  the  required 
knowledge.  The  necessary  combination  of  tacit  and  explicit  knowledge  could  either 
come  from  outside  sources  or  be  developed  internally  through  research  and  experi¬ 
mentation. 


The  example  of  Hizballah  is  instructive  in  this  regard.  In  the  late  1990s,  the 
group’s  state  sponsors  provided  it  with  sophisticated  wire-guided  TOW  antitank 
missiles  (such  technologies  are  a  form  of  explicit  knowledge).  But  those  sponsors 
were  unable  to  give  the  group  the  tacit  knowledge  needed  to  use  the  weapons  success¬ 
fully.  Because  the  militaries  of  Iran  and  Syria  used  the  weapons  in  ways  that  were  in¬ 
appropriate  to  Hizballah’s  circumstances,  the  training  they  provided  was  not  helpful. 
The  training  was  based  on  traditional  military  doctrine,  which  included  firing  the 
weapons  from  relatively  open  positions.  This  approach  is  appropriate  for  large  units 
that  can  defend  themselves  against  counterattacks,  but  it  was  not  workable  for  the 
small  Hizballah  units,  which  could  be  quickly  destroyed  in  counterattacks.  Conse¬ 
quently,  the  terrorist  group  had  to  developing  tacit  knowledge  internally  to  utilize 
the  weapons  in  ways  that  were  consistent  with  its  circumstances  (Susser,  2000).  The 
group  learned  to  fire  the  weapons  from  inside  villages  and  was  then  able  to  use  them 
effectively  while  minimizing  the  risk  to  the  firing  teams. 

Because  of  its  leaderless  resistance  model,  the  ELF/ALF  could  be  significantly 
constrained  if  carrying  out  its  attacks  required  extensive  tacit  knowledge.  Similarly,  if 
new  ELF/ALF  “members”  (many  of  whom  lack  experience  in  violent  activities)  have 
to  undertake  an  extensive  learning  process,  they  might  be  discouraged  from  acting  to 
advance  the  movement’s  agenda.  Therefore,  ELF/ALF  has  chosen  tactics  that  require 


33  For  any  given  activity,  there  will  likely  be  more  than  one  combination  of  essential  tacit  and  explicit  knowledge. 
For  example,  to  carry  out  sniper  operations,  a  terrorist  group  could  obtain  appropriate  equipment  and  training  on 
the  international  arms  market,  could  build  the  equipment  from  scratch  and  teach  its  members  how  to  use  it,  or 
could  select  one  of  a  number  of  other  possible  acquisition  and  learning  strategies.  See,  for  example,  Smithson, 
1999,  pp.  1 1-69,  for  an  analysis  of  the  knowledge  and  expertise  required  for  the  acquisition  and  use  of  particular 
types  of  unconventional  weapons. 
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very  little  tacit  knowledge.  The  attacks  described  in  ELF/ALF  manuals  (explicit 
knowledge  disseminated  via  the  Internet)  are  basic  in  nature — vandalism,  arson,  and 
other  simple  tactics — and  require  minimal  tacit  knowledge  to  be  used  successfully 
(Trujillo,  2005).  ELF/ALF  has  increased  the  chance  that  its  learning  efforts  will  be 
successful  by  constraining  those  efforts  to  comparatively  modest  goals. 

Aum’s  goals  presented  a  much  higher  hurdle.  The  successful  manufacture  of 
biological  weapons  requires  significant  amounts  of  both  tacit  and  explicit  knowledge, 
including  the  biology  knowledge  needed  to  identify  and  obtain  hazardous  organisms, 
the  biochemistry  expertise  needed  to  grow  them,  and  multidisciplinary  knowledge 
needed  to  weaponize  and  disseminate  them  efficiently.  In  its  efforts  to  produce  these 
weapons,  Aum  Shinrikyo  gained  part  of  the  required  knowledge,  but  not  all,  and  as  a 
result,  its  biological  weapons  program  was  largely  a  failure.  Although  it  collected  a 
wide  range  of  relevant  explicit  knowledge  (e.g.,  published  scientific  literature),  Aum 
did  not  seek  out  relevant  sources  of  tacit  knowledge,  apparently  intent  on  learning 
what  it  needed  to  learn  on  its  own.  This  is  somewhat  surprising,  since  the  group’s 
extensive  connections  in  Russia  could  have  connected  it  with  weapons  scientists  pos¬ 
sessing  significant  knowledge  of  these  topics  (Parachini,  2005).  Access  to  such 
knowledge  sources  could  have  significantly  increased  the  group’s  ability  to  produce 
effective  biological  agents. 


Acting  More  Effectively  to  Thwart  Terrorist  Efforts 

Because  learning  capabilities  are  highly  important  for  the  adaptability  and  function¬ 
ing  of  terrorist  organizations,  an  understanding  of  how  such  groups  learn  could  sig¬ 
nificantly  enhance  law  enforcement  and  intelligence  operations.  Knowledge  of  group 
learning  processes  could  contribute  to  evaluating  and  improving  efforts  to  combat 
terrorism,  and  in  addition,  to  the  extent  that  a  terrorist  group’s  internal  learning 
processes  can  be  understood,  it  could  suggest  novel  ways  to  take  on  terrorist  groups, 
e.g.,  by  blunting  the  effectiveness  of  their  learning  abilities  or  using  those  capabilities 
against  them  to  undermine  their  operational  effectiveness.  As  illustrated  in  Figure 
4.5,  an  understanding  of  group  learning  can 

•  Illuminate  the  reciprocal  relationships  between  actions  to  combat  terrorism  and 
terrorist  group  learning  efforts 

•  Suggest  novel  strategies  to  combat  terrorism  that  (1)  target  group  learning  ac¬ 
tivities  or  (2)  divert  those  activities  or  shape  their  outcomes 
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Figure  4.5 
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The  Reciprocal  Relationship  Between  Actions  to  Combat  Terrorism 
and  Terrorist  Groups'  Efforts  to  Adapt  and  Change 

Terrorist  groups  are  almost  always  struggling 
against  a  range  of  security  and  law  enforcement 
organizations.  The  actions  of  those  counterter¬ 
rorist  organizations  have  a  direct  and  powerful 
effect  on  what  and  how  terrorist  groups  learn. 
Actions  taken  to  combat  terrorism  provide  a 
powerful  incentive  for  a  group  to  continue  to 
learn,  since  a  terrorist  group  that  does  not  adapt  in  response  to  new  security  or  intel¬ 
ligence  measures  will,  at  the  minimum,  be  rendered  ineffective  or,  more  likely,  will 
be  infiltrated  and  dismantled.  The  constant  evolution  in  countermeasures  requires 
terrorist  groups  to  continually  move  forward  simply  to  preserve  their  current  level  of 
capabilities,  a  state  that  has  been  described  as  “the  technology  treadmill”  (Hoffman, 

1998,  p.  180). 

In  a  dynamic  contest  between  organizations,34  an  advantage  gained  by  one  side 
prompts  the  other  side  to  attempt  to  offset  or  degrade  that  advantage.  Law  enforce¬ 
ment  and  intelligence  planners  need  to  understand  how  the  “moves”  made  by  secu¬ 
rity  forces  shape  or  determine  the  “moves”  made  by  terrorist  group  adversaries.35  Our 


"Law  enforcement  and  intelli¬ 
gence  planners  need  to  under¬ 
stand  how  the  'moves'  made  by 
security  forces  shape  or  determine 
the  'moves'  made  by  terrorist 
group  adversaries." 


34  For  discussion  of  terrorist  groups  not  included  in  our  case  studies,  see  Cragin  and  Daly,  2004. 

35  This  knowledge  could  contribute  to  efforts  to  understand  terrorist  organizations  as  complete  systems  that  can 
be  influenced  through  a  range  of  mechanisms  (Davis  and  Jenkins,  2002),  and  also  to  modeling  the  give-and-take, 
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case  study  groups  made  a  variety  of  changes  to  their  organizational  structures,  tactics, 
and  activities  in  response  to  security  or  other  pressures.  They  aimed  their  activities 
both  at  directly  countering  protective  measures  and  at  circumventing  the  ways  law 
enforcement  and  intelligence  organizations  gather  the  information  they  need  to  dis¬ 
rupt  attacks  and  prosecute  suspected  terrorists. 

The  terrorist  groups  also  demonstrated  their  ability  to  learn  directly  from  secu¬ 
rity  forces,  a  learning  activity  that  is  particularly  important  when  the  groups  target 
members  of  those  organizations.36  PIRA  and  Hizballah  staged  a  significant  fraction 
of  their  operations  against  security  forces  and  military  organizations.  These  terrorist 
groups  exploited  opportunities  to  learn  from  their  opponents,  both  through  observa¬ 
tion  and  by  building  dedicated  intelligence-gathering  capabilities.  These  efforts  in¬ 
formed  the  groups’  overall  security  efforts  and  helped  them  to  design  specific  attack 
operations.  Using  information  it  collected  on  the  Israeli  military,  for  example,  Hiz¬ 
ballah  modified  its  tactics  to  defeat  the  military’s  likely  countermoves.  Similarly,  in 
designing  its  attack  on  a  military  patrol  at  Warrenpoint  in  1979,  PIRA  drew  on  ob¬ 
servations  of  how  the  British  Army  had  responded  in  similar  incidents  at  that  site 
(Harnden,  2000,  p.  199). 

Adaptations  by  terrorist  groups  can  affect  learning  efforts  carried  out  by  law  en¬ 
forcement,  intelligence,  or  other  security  force  organizations  as  well.  Modifications 
that  terrorist  groups  make  in  their  operations  can  render  indicators  used  by  intelli¬ 
gence  and  law  enforcement  to  track  and  gauge  the  terrorists’  activities  (e.g.,  estimates 
of  a  group’s  weapons  stocks)  “obsolete.”  As  PIRA  became  more  adept  at  producing 
bombs,  mortars,  and  RPGs,  it  had  no  need  to  stockpile  these  weapons.  Instead,  it 
could  manufacture  a  weapon  immediately  before  an  attack  (Jackson,  2005).  This  had 
significant  logistical  benefits  for  the  group,  and  it  also  meant  that  estimates  of  stored 
weapons  became  a  much  less  valid  indicator  of  the  group’s  capabilities  and  intent. 

Because  terrorist  groups  will  always  seek  to  circumvent  or  defeat  measures  in¬ 
tended  to  combat  terrorism,  this  type  of  back-and-forth  learning  between  the  two 
sides  will  occur  in  all  such  conflicts.  To  the  extent  that  a  deeper  understanding  of  a 
group’s  learning  processes  can  enable  analysts  to  anticipate  its  ability  to  respond  to  a 
given  countermeasure,  it  will  be  possible  to  design  more-effective  interdiction  and 
security  measures. 


measure-countermeasure  interactions  using  game-theory  approaches  (e.g.,  Overgaard,  1994;  Pate-Cornell  and 
Guikema,  2002;  Sandler  and  Arce  M.,  2003). 

36  This  type  of  learning  can  be  particularly  advantageous  against  opponents  that  themselves  do  not  learn  or  adapt 
well  in  response  to  the  terrorists’  actions. 
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Devising  New  Strategies  for  Combating  Terrorism  by  Curtailing 
Group  Learning  Ability 

Given  the  potential  impact  of  effective  learning, 
law  enforcement  and  intelligence  organizations 
might  seek  to  reduce  the  ability  of  terrorist 
groups  to  learn  or  might  attempt  to  short- 
circuit  their  ongoing  learning  efforts.  Yet  efforts 
to  combat  terrorism  frequently  do  not  explicitly 
address  terrorist  group  learning.  Because  learning  is  a  route  the  terrorist  organization 
takes  to  blunt  or  circumvent  countermeasures,  many  efforts  to  combat  terrorism  only 
seek  to  overwhelm  the  group’s  ability  to  learn  its  way  around  the  counterefforts. 

With  a  sufficiently  detailed  understanding  of  terrorist  groups’  learning  proc¬ 
esses,  it  could  be  possible  to  design  countermeasures  that  directly  address  or  even  take 
advantage  of  the  attempts  groups  make  to  learn.37  Participants  in  our  project  work¬ 
shop  discussions  were  particularly  enthusiastic  about  the  potential  contribution  of 
analysis  focused  on  organizational  learning  to  the  development  of  new  strategies  for 
combating  terrorism.  Drawing  on  those  discussions  and  the  results  of  the  case  stud¬ 
ies,  we  identified  two  overarching  approaches  (Figure  4.6):38 

•  Target  group  learning  activities  directly  to  reduce  terrorists’  ability  to  adapt  over 
time 

•  Take  action  to  divert  terrorist  groups’  learning  efforts  or  influence  the  outcomes 
of  such  efforts 

Directly  Targeting  Terrorist  Group  Learning  Activities 

Preventing  a  terrorist  group  from  learning 
could  provide  a  means  of  limiting  its 
ties  overall,  even  when  taking  on  the  group  di¬ 
rectly  might  not  be  possible.  An  understanding 
of  terrorist  group  learning  efforts  could  also 
provide  a  “force  multiplier”  effect  for  traditional  efforts  to  combat  terrorism;  that  is, 
if  such  efforts  are  designed  to  be  as  disruptive  to  group  learning  processes  as  possible, 


"This  strategy  provides  an  ad¬ 
ditional  potential  target  to  act 
against:  a  group's  learning  sys¬ 
tem." 


"It  could  be  possible  to  design 
countermeasures  that  directly 
address  or  even  take  advantage 
of  the  attempts  groups  make  to 
learn." 


37  Such  a  strategy  is  consistent  with  strategic  principles  advanced  in  Thomas  and  Casebeer,  2004,  pp.  70-81. 

38  These  approaches  are  intended  to  highlight  ways  in  which  an  understanding  of  learning  could  be  uniquely 
useful  for  planning  efforts  to  combat  terrorism.  They  do  not  necessarily  constitute  a  comprehensive  listing  of  all 
the  possible  learning-directed  approaches  that  are  relevant  in  fighting  terrorism.  The  two  approaches  should  be 
viewed  as  promising  avenues  rather  than  as  definitive  proofs  of  any  one  avenue’s  specific  value.  Focused  study  will 
clearly  be  required  to  assess  the  utility  and  practicality  of  the  routes  that  appear  most  promising. 
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Figure  4.6 

Learning-Focused  Strategies  for  Combating  Terrorism 
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they  could  provide  a  boost  to  a  broader  effort  to  damage  a  group’s  capability  to  cause 
harm.  This  strategy  therefore  provides  an  additional  potential  target  to  act  against:  a 
terrorist  group’s  “learning  system.”39  40  An  understanding  of  group  learning  processes 
could  help  to  identify  potential  vulnerabilities  and  strategies  to  exploit  them.  The 
following  sections  describe  six  potential  strategies  aimed  at  undermining  a  terrorist 
group’s  ability  to  learn  and  adapt. 

Limit  Access  to  Critical  Knowledge  Resources.  Many  established  efforts  to  com¬ 
bat  terrorism  are  aimed  at  restricting  the  access  of  terrorist  groups  to  necessary 
knowledge  resources.  Programs  to  control  trafficking  in  weapons,  reduce  the  avail¬ 
ability  of  specific  technologies  or  information,  and  safeguard  nuclear  material  and 
other  substances  of  concern  are  all  intended  to  impact  terrorist  group  learning  activi¬ 
ties.  In  addition  to  such  traditional  efforts,  attempts  could  be  made  to  undermine 
group  learning  processes  by  either  making  knowledge  resources  less  attractive  to  the 
groups  or  casting  doubt  on  their  trustworthiness.  It  was  normal  for  the  case  study 
groups  to  consult  with  outside  experts  and  other  knowledge  sources  to  collect  infor- 


39  Depending  on  circumstances,  key  elements  of  a  terrorist  group’s  learning  processes  may  be  very  difficult  to 
reconstitute  after  security  force  intervention  damages  or  destroys  them.  As  a  result,  those  elements  may  represent 
particularly  attractive  targets  for  action  (workshop  discussions). 

40  This  is  consistent  with  the  approach  of  viewing  terrorist  organizations  as  complex  systems  of  different  people, 
functions,  and  capabilities  (Davis  and  Jenkins,  2002),  each  of  which  might  be  influenced  in  different  ways. 
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mation  and  knowledge.  Strategies  such  as  well-publicized  sting  operations  that  in¬ 
crease  the  apparent  risk  of  such  interactions  or  attempts  to  “pollute”  knowledge  re¬ 
sources41  could  impact  learning  in  some  groups.42 

Information  on  terrorist  group  learning  could  also  contribute  to  better  design  of 
programs  aimed  at  denying  critical  knowledge  and  better  allocating  resources  among 
such  programs.  Understanding  the  nature  of  the  knowledge  required  for  certain  ac¬ 
tivities  and  the  routes  terrorist  groups  follow  to  gain  that  knowledge  is  important  for 
any  effort  to  limit  access  to  particular  types  of  knowledge.  Certain  kinds  of  explicit 
knowledge  can  be  transferred  so  readily  and  widely  that  any  attempt  to  block  that 
transfer  will  be  ineffectual.43  Depending  on  the  types  of  knowledge  and  expertise 
held  by  terrorist  groups,  other  strategies  may  also  have  very  limited  potential  benefits. 
For  example,  if  a  group  has  the  capability  to  manufacture  its  own  weapons,  efforts  to 
restrict  its  access  to  the  arms  market  will  have  a  much  lower  payoff  than  will  such 
efforts  against  groups  that  cannot  manufacture  their  own  weapons.  Since  tacit 
knowledge  is  much  more  difficult  to  transfer,  focusing  efforts  on  preventing  access  to 
key  tacit-knowledge  resources  may  be  particularly  attractive.44 

Identify  and  Address  Development  of  New  Knowledge  Sources  That  Are 
Attractive  to  Terrorist  Organizations.  An  understanding  of  terrorist  group  learning 
practices  can  also  assist  in  identifying  the  development  of  new  knowledge  sources 
that  could  be  particularly  useful  to  terrorist  groups  and  could  inform  efforts  to  pre¬ 
vent  terrorists  from  gaining  access  to  such  sources.  Arms  manufacturers  are  moving 
toward  systems  that  require  considerably  less  tacit  knowledge  to  be  used  effectively. 
For  example,  advanced  infantry  weapons  are  currently  being  developed  that  capture, 
in  both  hardware  and  software,  much  of  the  knowledge  that  would  be  needed  to  use 
them  successfully  for  specialized  functions.  For  older  generations  of  precision  fire¬ 
arms,  such  as  sniper  rifles,45  soldiers  had  to  accrue  significant  amounts  of  tacit 
knowledge  on  such  topics  as  range  estimation  and  correction  for  environmental  in- 


41  For  example,  countering  Internet  information  on  bomb  making  with  seemingly  authentic  but  ineffective  red- 
pes. 

42  In  all  cases,  the  potential  benefit  of  such  strategies  (which  would  depend  heavily  on  the  specific  terrorist  group 
being  targeted)  would  have  to  be  weighed  against  their  inherent  uncertainty  and  potential  negative  consequences. 

43  For  example,  the  transmission  of  basic  data  on  tactics  and  their  success  through  the  media  (for  example, 
Holden’s  1986  analysis  of  the  contagiousness  of  airline  hijackings)  or  widely  reported  general  vulnerability  infor¬ 
mation. 

44  Established  efforts  to  discourage  weapons  scientists  from  collaborating  with  terrorist  organizations  provide  an 
excellent  example.  Depending  on  the  context,  targeted  initiatives  might  be  designed  to  discourage  individuals 
with  specific  military  knowledge,  "insider  data”  on  key  infrastructures  or  other  targets,  or  other  relevant  tacit 
knowledge  from  interacting  with  or  otherwise  instructing  terrorist  organizations. 

45  For  example,  the  Barrett  90  and  Belgian  FN  sniper  rifles  used  by  PIRA  in  attacks  on  security  forces  (Harnden, 
2000). 
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fluences.46  The  new  weapons  incorporate  technology  systems  that  carry  out  these 
functions,  eliminating  much  of  the  learning  requirement  (Cutshaw,  2002).  Such  ad¬ 
vances  significantly  “lower  the  bar”  in  terms  of  learning  for  terrorist  organizations.  If 
analogous  technologies  had  been  available  at  the  time,  PIRA  would  have  avoided  the 
significant  difficulties  it  encountered  with  RPGs,  since  the  tacit  knowledge  would 
have  been  built  into  the  weapons  themselves  (Jackson,  2005).  As  advanced  technolo¬ 
gies  are  developed,  incorporating  measures  that  limit  the  ability  of  unauthorized  per¬ 
sons  to  use  the  weapons  or  reduce  the  chances  of  their  falling  into  terrorists’  hands 
becomes  much  more  important.47 

Identify  and  Target  Terrorist  Groups'  "Learning  Leadership."  Knowledge  of  a 
terrorist  group’s  learning  processes  could  also  be  used  to  better  target  key  individuals 
and  thereby  limit  a  group’s  ability  to  adapt  and  evolve.  Identification  of  key  indi¬ 
viduals  is  a  frequent  element  of  efforts  to  combat  terrorism  (see,  e.g.,  Kenney, 
2003a).  By  focusing  on  how  a  group  learns,  analysts  may  be  able  to  identify  individ¬ 
ual  members  who  play  key  roles  in  learning  processes.  In  some  terrorist  groups,  lead¬ 
ers  play  a  central  role  in  group  interpretation  efforts  and  represent  key  vulnerabilities. 
One  such  individual  was  Aum’s  Asahara  (Parachini,  2005).  While  the  capture  of 
central  individuals  could  clearly  have  a  broad  effect  on  group  learning  capabilities,  a 
terrorist  group’s  “learning  leadership”  may  or  may  not  be  the  same  as  its  political  or 
organizational  leadership.  The  learning  leaders  could  be  technical  specialists  or  indi¬ 
viduals  who  play  important  roles  in  managing  or  supporting  the  learning  efforts  of 
others  in  the  group.48 

Identify  and  Break  Interconnections  Among  Terrorist  Group  Members  That  Are 
Important  for  Learning.  Past  studies  of  social  networks  within  terrorist  groups  have 
produced  a  range  of  insights  into  how  the  interconnections  among  individual  mem¬ 
bers  of  groups  or  among  subunits  of  a  larger  organization  affect  group  functioning 
and  performance  (see,  for  example,  Carley  et  ah,  2001).  These  studies  map  informa¬ 
tion  such  as  communications  traffic,  meetings,  family  connections,  or  shared  experi¬ 
ences  among  individuals  to  discern  the  nature  of  the  networks  that  exist  inside  orga¬ 
nizations.  They  have  suggested  that  because  of  the  importance  of  interpersonal 


46  This  is  in  stark  contrast  to  general-purpose  assault  weapons,  such  as  the  AK-47  and  Armalite  rifle,  which 
(when  used  for  nonspecialized  functions)  require  a  minimal  amount  of  expertise/ tacit  knowledge  to  be  used  effec¬ 
tively:  “The  virtue  [of  the  Armalite]  is  that  it  is  easy  to  use.  It  must  be  stressed  again  that  most  urban  guerrillas 
learn  on  the  job.  Very  few  have  fired  many  shots  in  practice.  Very  few  have  had  any  formal  military  training.  Very 
few  handle  weapons  with  special  skill.  The  Armalite,  in  particular,  does  not  need  very  special  skills”  (Bell,  1987, 
p.  53). 

47  Of  course,  such  newer,  more-sophisticated  weapons  also  are  far  more  expensive  and  may  require  specialized 
maintenance  practices.  While  lowering  the  bar  in  one  regard,  they  may  raise  it  in  another. 

48  Steven  and  Gunaratna  cite  Israeli  targeting  ofYahiya  Ayyash,  “the  Engineer,”  a  key  bombmaker  in  Hamas,  as 
an  example  of  this  tactic.  However,  the  response  to  the  action  is  also  instructive:  The  terrorist  group  began  to 
train  and  disperse  larger  numbers  of  bombmakers  to  limit  the  chance  of  their  capabilities  being  similarly  damaged 
again  (Steven  and  Gunaratna,  2004,  pp.  185-186). 
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connections  to  a  terrorist  group’s  ability  to  act,  targeting  the  linkages  among  the 
members  of  an  organization  would  be  an  attractive  way  to  degrade  its  cohesion  and 
capability.  Successfully  targeting  key  nodes  in  a  terrorist  group’s  network  could  pre¬ 
vent  coordination  among  different  parts  of  the  organization  or  could  even  cause  the 
group  to  fall  apart. 

An  understanding  of  terrorist  group  learning  activities  would  provide  an  addi¬ 
tional  element  to  such  analyses.  To  the  extent  that  group  learning  processes  are  un¬ 
derstood  and  members  are  known  to  investigators,  those  who  play  key  roles  in  group 
learning  processes  could  be  targeted.49  Individuals  who  are  key  for  group  learning 
may  or  may  not  be  the  same  as  those  identified  using  other  social-network-related 
variables  such  as  communications  traffic.  Information  about  the  effectiveness  of  a 
terrorist  group’s  internal  network — for  example,  whether  it  is  effective  at  transferring 
tacit  as  well  as  explicit  knowledge — could  enhance  such  analyses  to  enable  better  tar¬ 
geting  of  disruptive  efforts. 

Although  breaking  up  terrorist  group  interconnections  is  promising,  caution 
should  be  used  in  designing  and  implementing  such  an  approach.  The  effects  of  such 
an  intervention  could  be  quite  different  in  different  groups.  Those  whose  learning 
efforts  rely  on  direction  and  coordination  through  centralized  nodes  may  be  unable 
to  recover  if  those  nodes  are  eliminated.  However,  breaking  individual  units  away 
from  their  larger  group  could  also  free  those  units  from  learning  constraints  imposed 
by  the  overall  organization.  The  differences  observed  in  innovative  activities  among 
PIRA’s  units,  for  example,  suggest  that  the  additional  individual  unit  autonomy  such 
interventions  could  produce  might  generate  more  variety  and  experimentation  at  the 
tactical  level  than  would  exist  if  centralized  control  was  maintained  (Jackson,  2005). 
To  the  extent  that  a  terrorist  group’s  reaction  to  such  operations  could  be  anticipated 
on  the  basis  of  its  past  history,  the  potential  costs  and  benefits  of  these  types  of  inter¬ 
ventions  could  be  more  clearly  assessed. 

Design  Strategies  to  Maximize  the  Learning  Burden  Placed  on  Groups.  An  un¬ 
derstanding  of  how  specific  terrorist  groups  learn  may  make  it  possible  to  design 
measures  that  maximize  the  burden  placed  on  group  learning  and  minimize  the 
groups’  ability  to  respond  through  adaptive  behavior  (workshop  discussions).  Such 
“counteradaptive  strategies”  (see  Gerwehr  and  Glenn,  2003,  pp.  49-57,  where  this 
concept  is  introduced)  would  seek  to  maximize  the  disruptive  effects  of  such  mea¬ 
sures.  Examples  of  counteradaptive  strategies  include  (Gerwehr  and  Glenn,  2003; 
workshop  discussions) 

•  Using  combinations  of  different  approaches.  A  group  has  some  maximum 

number  of  different  learning  tasks  that  it  can  carry  out  simultaneously.  If  multi- 


49  Steven  and  Gunaratna  (2004)  describe  such  actions  as  targeting  the  “middle  management”  of  terrorist  organi¬ 
zations. 
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pie  counterterrorism  measures  are  applied  at  once,  a  group  may  not  have  suffi¬ 
cient  learning  capability  to  respond  effectively  to  all  of  them. 50 

*  Building  randomness  into  the  application  of  counterterrorism  strategies.  A  key 
part  of  all  learning  processes  is  discerning  cause-and-effect  relationships  between 
a  group’s  actions  and  the  outcomes  they  produce.  A  reasonable  level  of  ran¬ 
domness  in  the  way  different  counterterrorism  techniques  are  applied — for  ex¬ 
ample,  randomness  in  intensity,  time,  and  nature — could  limit  terrorist  groups’ 
ability  to  assess  the  counterterrorist  efforts  and  build  response  strategies. 

•  Adjusting  the  timing  and  speed  of  the  application  of  countermeasures.  No 
matter  how  great  its  capabilities,  a  terrorist  group  needs  time  to  carry  out 
learning  activities  and  implement  their  results.  Adjusting  the  timing  of  coun¬ 
terterrorism  actions — for  example,  by  introducing  new  measures  in  rapid  suc¬ 
cession  or  quickly  shifting  tactics  from  one  type  of  counterstrategy  to  a  very  dif¬ 
ferent  one — could  limit  a  group’s  ability  to  learn  and  respond  effectively. 

The  specific  requirements  for  developing  and  implementing  counteradaptive  strate¬ 
gies  will  differ  among  terrorist  organizations.  Building  an  understanding  of  a  group’s 
learning  behaviors,  including  the  limits  of  its  learning  capabilities,  is  a  critical  starting 
point  for  making  such  strategies  available  to  law  enforcement  and  intelligence  plan¬ 
ners. 

Deny  the  Safe  Haven  Needed  for  Experimentation  and  Innovation.  Another 
well-established  strategy  for  combating  terrorism  is  denial  of  sanctuaries  or  safe  ha¬ 
vens.  While  safe  havens  are  useful  to  organizations  for  many  reasons,  they  are  par¬ 
ticularly  important  for  research,  experimentation,  training,  and  other  learning-related 
activities.  PIRA,  JI,  Hizballah,  andAum  all  utilized  different  types  of  safe  havens  to 
carry  out  their  learning  activities.  Similarly,  the  availability  of  safe  havens  was  related 
to  terrorist  groups’  willingness  to  set  up  and  use  more-effective  information  storage 
systems  such  as  computer  archives  and  physical  records.51'52 

To  deny  terrorist  groups  safe  havens  as  effectively  as  possible,  law  enforcement 
and  intelligence  planners  must  be  able  to  define  what  constitutes  a  safe  haven  for  spe¬ 
cific  group  activities.  For  example,  the  level  of  sanctuary  a  terrorist  group  requires  for 
basic  experimentation  with  explosive  devices  is  very  different  from  that  required  for  a 
large-scale  military  training  program.  Knowledge  of  the  learning  requirements  for 
specific  activities  of  concern  would  facilitate  analysis  of  what  might  be  the  minimal 


50  The  specific  combination  of  measures  and  the  number  of  different  measures  that  would  need  to  be  combined 
to  overwhelm  a  terrorist  group’s  learning  capability  probably  differ  considerably  from  group  to  group. 

51  Anthony  Davis  (2002)  describes  a  set  of  al  Qaeda’s  computerized  files,  including  personnel  data  on  individual 
group  members,  seized  in  Afghanistan. 

52  Invading  safe  havens  to  destroy  such  storage  systems  has  been  highlighted  by  others  as  a  key  counterterrorism 
mission  (Simmons  et  al.,  2003). 
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requirements  for  a  corresponding  safe  haven.  Such  an  analysis  could  help  ensure  that 
actions  to  eliminate  havens  have  the  desired  effect  (workshop  discussions). 

Intervening  to  Divert  Terrorist  Group  Learning  or  Shape  Its  Outcomes 

Rather  than  attempting  to  directly  prevent  a 
terrorist  group  from  learning,  strategies  could 
also  be  designed  to  take  a  less  direct  approach. 
Diverting  group  learning  efforts  is  a  fundamen¬ 
tal  goal  of  most  efforts  to  combat  terrorism.  If  a 
group  is  concerned  about  its  own  security  and 
the  potential  for  infiltration  by  intelligence  or  law  enforcement  operatives,  it  will  be 
forced  to  focus  learning  resources  on  defensive  measures  rather  than  offensive  opera¬ 
tions.53  As  a  result,  even  the  most  generic  counterefforts  can  provide  the  opportunity 
to  shift  a  terrorist  group’s  “learning  budget”  in  ways  that  could  reduce  the  outward 
threat  the  group  poses.  A  more  direct  approach  to  influencing  terrorist  group  learn¬ 
ing  can  be  found  in  stated  policies  of  massive  retaliation  against  terrorist  groups  that 
use  certain  types  of  weapons.  Such  policies,  generally  aimed  at  the  use  of  unconven¬ 
tional  weapons,  seek  to  deter  terrorist  groups  from  undertaking  the  learning  needed 
to  acquire  those  weapons  in  the  first  place  (see,  for  example,  Jenkins,  20 02). 54 

Beyond  these  strategies  for  general  deterrence  and  influencing  group  learning 
decisions,  law  enforcement  and  intelligence  agencies  could  potentially  attempt  to  di¬ 
rectly  affect  the  nature  and  outcome  of  terrorist  group  learning  activities.  If  a  suffi¬ 
ciently  detailed  model  of  a  group’s  learning  processes  and  capabilities  were  available, 
use  of  deception,55  misinformation,56  and  other  psychological  operations  could  make 
it  possible  to 


"Law  enforcement  and  intelli¬ 
gence  agencies  could  potentially 
attempt  to  directly  affect  the  na¬ 
ture  and  outcome  of  terrorist 
group  learning  activities." 


53  This  effect  is  discussed  by  Moghadam  with  reference  to  Palestinian  groups  (Moghadam,  2003). 

54  Terrorist  group  concerns  about  security  at  desired  targets,  technical  countermeasures,  and  other  steps  that  in¬ 
crease  operational  uncertainty  can  also  affect  the  way  groups  allocate  learning  resources.  Such  measures  can  in¬ 
duce  groups  to  devote  more  time  and  effort  to  planning  individual  operations — to  increase  their  “robustness” 
against  the  countermeasures  and  increase  their  chance  of  success — and  therefore  might  constrain  the  total  number 
of  separate  operations  a  group  is  able  to  carry  out. 

55  Significant  work  has  been  performed  on  the  theory  and  practical  implementation  of  deception  operations, 
both  in  a  traditional  military  context  and  in  the  targeting  of  nonstate  actors  such  as  terrorist  groups  (see,  for  ex¬ 
ample,  Gerwehr  and  Glenn,  2000,  2003).  We  do  not  attempt  to  address  this  literature  in  any  comprehensive  way; 
rather,  we  are  simply  highlighting  the  relevance  of  the  technique  to  influencing  terrorist  group  learning. 

56  Workshop  participants  also  pointed  out  that  such  operations  could  provide  a  way  to  gather  primary  informa¬ 
tion  on  terrorist  group  learning  processes.  After  specific  types  of  information  are  released  to  known  representatives 
of  an  organization,  the  “progress”  of  the  information  through  group  distribution  channels  can  be  monitored  as  a 
way  of  mapping  out  information  flows  or  their  effect  on  terrorist  group  behavior  to  provide  insights  into  the 
group’s  interpretation  process  (workshop  discussions). 
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•  Steer  terrorist  group  learning  in  particular  directions 

•  Influence  the  results  of  terrorist  groups’  learning  efforts57 

Steer  Terrorist  Group  Learning  Activities.  Deception  and  other  influence  tech¬ 
niques  could  be  aimed  at  steering  a  terrorist  group  away  from  specific  learning  activi¬ 
ties  that  could  increase  the  threat  it  poses.  Influence  operations  could  seek  to  guide 
groups  toward  technologies  that  are  more  readily  traced,  operations  that  are  less 
damaging  or  easier  to  thwart,  or  other  organizationally  dysfunctional  paths.  Such  op¬ 
erations  could  also  be  aimed  at  degrading  specific  components  of  a  terrorist  group’s 
learning  processes.  For  example,  given  the  potential  benefits  of  sophisticated  organi¬ 
zational  memories  to  group  learning  capabilities,  operations  could  attempt  to  increase 
terrorist  groups’  perceptions  of  the  risk  of  building  tangible  memory  resources.58 
These  operations  could  be  as  basic  as  publicizing  key  seizures  of  information  from 
group  memories  such  as  computer  systems  or  files;  misinformation  could  be  used  if 
no  actual  seizures  had  taken  place.59 

Influence  the  Outcome  of  Terrorist  Group  Learning  Processes.  Research  on  or¬ 
ganizational  learning  presents  a  range  of  other  potential  targets  for  deception  and  in¬ 
fluence  operations.  Because  of  the  complexity  of  the  environment  faced  by  most  or¬ 
ganizations,  it  is  often  difficult  for  even  the  best  strategic  planner  to  determine  with 
certainty  whether  the  choices  he  or  she  is  making  really  help  achieve  the  organiza¬ 
tion’s  goals.  Researchers  call  this  “causal  ambiguity”  (Lipshitz  et  al.,  2002;  Zollo  and 
Winter,  2002;  Taudes  et  al.,  2002,  and  references  therein) — a  difficulty  in  correctly 
linking  something  that  has  happened  to  an  organization,  whether  good  or  bad,  to  its 
appropriate  cause.60  Similarly,  many  organizations  are  afflicted  by  predispositions  in 
the  types  of  information  they  seek  and  the  rules  they  apply  to  interpret  the  informa¬ 
tion.  Researchers  have  particularly  highlighted  these  types  of  problems  in  terrorist 


57  Carrying  out  such  influence  operations  with  any  degree  of  certainty  of  effectiveness  would  require  a  high  level 
of  information  on  a  target  group’s  learning  activities.  Depending  on  the  practical  realities  of  operations  against 
specific  terrorist  groups,  an  agency  might  be  positioned  to  act  more  directly  against  an  adversary  group  before  it 
could  capture  sufficient  information  to  carry  out  these  types  of  operations  with  any  degree  of  certainty.  Never¬ 
theless,  influence  operations  could  provide  a  complementary  option  even  without  complete  information,  assum¬ 
ing  that  the  costs  of  the  operations  were  commensurate  with  the  more  uncertain  payoff. 

58  Terrorist  groups’  learning  processes  can  themselves  be  the  subject  of  learning;  that  is,  terrorist  organizations 
can  seek  to  “learn  to  learn  better.”  In  this  case,  the  goal  of  the  influence  operation  would  be  to  thwart  that  process 
and  lead  the  group  to  conclusions  that  result  in  less  learning  capability. 

59  Carrying  out  deception  and  influence  operations  against  a  terrorist  organization  would  require  significant  in¬ 
formation  on  the  mechanisms  through  which  the  terrorist  group  gathers  information  and  interprets  that  informa¬ 
tion.  Workshop  participants  viewed  the  reliance  of  the  case  study  groups  on  a  wide  variety  of  knowledge  sources 
as  potentially  useful  from  a  deception  standpoint,  as  it  provides  a  variety  of  ways  to  inject  information  into  a 
group’s  deliberative  processes. 

60  This  can  be  even  more  of  a  problem  for  groups  without  centralized  control,  as  individual  parts  of  the  group 
may  be  changing  many  things  simultaneously  in  an  effort  to  improve  performance.  Even  if  performance  does 
improve,  it  is  difficult  to  determine  what  change  was  responsible. 
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groups,  whose  clandestine  nature  and  high  level  of  threat  can  skew  behavior  and 
decisionmaking  (for  example,  Bell,  1994,  p.  127;  McCauley,  2002). 

Under  certain  circumstances,  deception  and  influence  operations  could  try  to 
capitalize  on  these  “natural”  failures  in  terrorist  group  learning.  For  example,  de¬ 
ceiving  a  group  about  the  impact  of  its  operations  could  make  ineffective  tactics 
appear  more  attractive  or  make  successful  techniques  appear  to  fail  (workshop  discus¬ 
sions).61  Injecting  a  level  of  random  disinformation  into  terrorist  groups’  data 
streams  could  similarly  seek  to  maximize  ambiguities  about  the  effectiveness  of  par¬ 
ticular  operations.62  In  all  cases,  the  goal  of  influence  operations  would  be  to  alter  the 
terrorist  group’s  perception  of  its  efforts  and  of  the  costs  and  benefits  of  its  current 
behaviors  or  potential  future  operational  options. 


61  Such  deception  regarding  this  type  of  “damage  assessment”  would  obviously  be  inappropriate  in  most  cases, 
given  the  wide  dissemination  of  information  about  most  terrorist  events. 

62  These  types  of  comparatively  sophisticated  operations  would  likely  require  detailed  information  on  terrorist 
groups’  learning  efforts  and  their  interpretation  processes  in  particular.  For  example,  operations  planners  would 
need  to  know  whether  group  decisionmakers  relied  on  single  sources  of  information  or  based  decisions  on  a 
broader  array  of  evidence,  how  they  weighted  different  types  of  information,  how  they  judged  success  and  failure, 
and  how  the  terrorist  group  was  likely  to  react  as  a  result:  Will  the  group  “give  up”  after  one  failure  or  will  it  focus 
on  learning  from  the  failure  as  it  designs  a  subsequent  attempt?  If  it  chooses  to  learn  from  the  failure,  the  poten¬ 
tial  benefits  of  this  type  of  operation  would  be  significantly  reduced.  In  the  absence  of  these  data,  the  chance  of 
such  operations  being  successful  would  be  considerably  reduced  and  could  risk  sending  "the  wrong  message,” 
producing  unintended  and  unpredictable  results. 


CHAPTER  FIVE 


Limitations  of  an  Organizational-Learning-Based 
Approach  for  Analysis  and  Operational  Planning 
in  Combating  Terrorism 


On  the  basis  of  our  analysis  and  discussions  with  law  enforcement  and  intelligence 
professionals,  we  believe  that  an  organizational-learning-based  approach  to  analyzing 
terrorist  group  behavior  can  make  significant  contributions  to  planning  and  opera¬ 
tions  for  combating  terrorism.  However,  this  approach  would  not  necessarily  be 
appropriate  in  every  situation. 


The  Need  to  Understand  Terrorist  Group  Structure 
and  Membership 

An  organizational-learning-based  framework  can  be  useful  for  understanding  terrorist 
group  activities  and  behaviors  only  if  information  is  available  about  the  organization1 
involved.  Because  learning  activities  and  processes  go  on  inside  an  organization,  the 
analyst  must  have  enough  information  on  these  internal  workings  to  build  a  plausible 
model  of  the  organization — a  model  that  provides  a  starting  point  for  framing  and 
testing  hypotheses  about  the  group’s  learning  behaviors.  For  example,  if  a  terrorist 
organization’s  membership  is  completely  unknown,  it  is  very  difficult  to  frame  ques¬ 
tions  and  test  hypotheses  about  how  information  is  distributed  among  its  members 
and  how  that  distribution  could  affect  the  group’s  ability  to  learn.2  Building  models 
based  on  available  intelligence  data  is  a  central  task  for  any  analyst  studying  terrorist 


1  It  is  also  relevant  to  note  that  an  analytical  approach  focused  on  organizational  learning  is  useful  only  for  de¬ 
scribing  the  actions  of  groups.  Such  concepts  as  “distribution  of  knowledge”  and  “organizational  memory”  are  not 
applicable  to  terrorist  activities  carried  out  by  individuals  in  isolation.  Individuals  must  still  learn  what  they  need 
to  know  to  carry  out  their  violent  activities,  but  organizational  learning  concepts  are  not  appropriate  for  under¬ 
standing  that  process.  The  learning  challenges  faced  by  individual  terrorists  due  to  their  lack  of  organization  have 
been  cited  as  an  argument  why  such  “amateur  terrorism”  poses  an  overall  lower  threat  level  (Tucker,  2001, 
p.  135). 

2  The  lack  of  models  for  terrorist  “fronts”  or  “movements”  that  use  a  leaderless  resistance  strategy  (such  as 
ELF/ALF)  makes  application  of  such  frameworks  problematic. 
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group  behavior.3  As  a  result,  although  the  requirement  for  detailed  information  on 
internal  group  processes  may  limit  the  applicability  of  these  approaches,  it  is  less  of  a 
barrier  than  might  be  initially  assumed,  and  it  can  be  directly  addressed  by  intelli¬ 
gence  and  law  enforcement  in  the  design  of  collection  priorities. 

Analysts  of  group  learning  activities  must  also  carefully  select  the  most  appro¬ 
priate  “unit  of  analysis”  for  a  terrorist  group’s  learning  activities.  In  some  terrorist 
organizations,  the  entire  group  may  be  involved  in  learning.  In  others,  only  subunits 
of  the  group  may  be  actively  learning.  Aum  Shinrikyo’s  biological  and  chemical 
weapons  research  was  carried  out  by  a  small  group  of  people  close  to  Asahara,  the 
group’s  leader.  Viewing  the  entire  cult,  which  had  tens  of  thousands  of  members,  as 
the  unit  of  analysis  would  therefore  not  be  appropriate  and  would  lead  to  invalid 
conclusions  (Parachini,  2005).  Similarly,  within  PIRA,  different  units  learned  with 
very  different  degrees  of  effectiveness;  the  elite  units  reportedly  carried  out  the  most- 
advanced  learning  activities  (Jackson,  2005).  Modeling  the  learning  activities  of 
ELF/ALF  is  even  more  complex,  since  the  lack  of  strong  connections  among  even  its 
smallest  subunits  means  that  the  organization  cannot  learn  in  the  same  way  that 
more  closely  connected  and  coordinated  groups  do  (Trujillo,  2005).  The  literature 
does  not  provide  an  unambiguous  definition  of  “organization”  for  the  purposes  of 
studying  organizational  learning.  Rather,  it  highlights  the  importance  of  consider¬ 
ing — and  collecting — the  necessary  information  to  determine  whether  an  entire  or¬ 
ganization  is  involved  in  learning  or  learning  varies  among  subunits  of  the  group. 


Lack  of  Data  on  Terrorist  Group  Learning  Processes 

To  understand  organizational  learning  in  any  group,  it  is  necessary  to  have  informa¬ 
tion  on  the  processes  the  group  uses  to  gather  knowledge,  to  interpret  it,  to  distribute 
it,  and  to  store  it  in  an  organizational  memory.  Such  data  are  often  difficult  to  col¬ 
lect.  Even  for  organizations  that  are  open  to  study,  analysts  must  frequently  rely  on 
survey  or  other  techniques  to  collect  relevant  information  from  individual  group 
members.  Data  on  an  organization’s  outputs,  which  can  indicate  learning-induced 
change,  are  also  frequently  difficult  to  collect  because  of  the  inability  to  identify  and 
measure  all  the  different  outputs. 

These  problems  are  multiplied  for  terrorist  groups.  Though  significant  data  are 
frequently  available  on  terrorist  incidents  where  groups  act  overtly,  data  on  other  ac¬ 
tions  may  be  difficult  to  obtain.  Information  on  failed  operations  by  organizations 


3  Examination  of  a  terrorist  group’s  learning  behavior  can  provide  an  opportunity  to  test  and  validate  currently 
accepted  models  of  the  group’s  structure  and  internal  activities.  Data  on  its  knowledge-gathering  activities,  loci  of 
interpretation,  likely  distribution  pathways  and  modes,  and  sites  of  organizational  memory  can  also  be  used  to 
critique  the  model.  For  example,  learning  activities  that  appear  inconsistent  with  the  assumed  group  structure 
may  help  to  identify  problems  in  a  model. 
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that  have  effective  internal  operational  security  practices  may  not  be  available.  In  ad¬ 
dition,  the  validity  of  data  used  to  evaluate  terrorist  groups’  activities  and  prowess 
may  be  damaged  by  reporting  biases  or  the  actions  of  others,  such  as  clandestine  dis¬ 
ruption  of  terrorist  operations  unknown  to  the  analyst  examining  apparent  failures. 
Depending  on  the  nature  of  ongoing  operations  against  a  terrorist  organization,  the 
impact  of  law  enforcement  or  intelligence  operations,  both  U.S.  and  particularly 
those  of  other  nations,  could  significantly  bias  available  data  on  group  activities.  Such 
complications  make  it  more  difficult  to  apply  learning-focused  models  to  specific 
groups,  but  this  limitation  is  also  within  the  control  of  intelligence  and  law  enforce¬ 
ment  organizations  via  the  design  of  focused  information-gathering  efforts. 


The  Nature  of  Learning  Models 

An  analysis  built  on  an  understanding  of  terrorist  organizational  learning  behavior 
addresses  changes  in  group  activities  over  time.  Learning-based  theories  focus  on  un¬ 
derstanding  individual  terrorist  attacks,  activities,  or  behaviors  as  part  of  an  overall 
pattern  within  a  history  of  previous  actions.  They  cannot  provide  insight  into  indi¬ 
vidual  terrorist  events  in  isolation.  In  the  context  of  operational  histories,  the  impli¬ 
cations  of  learning  activities  could  be  quite  different  for  different  terrorist  organiza¬ 
tions.  For  example,  the  concepts  of  continuous  and  discontinuous  learning  are 
relative:  A  change  that  might  be  an  incremental  part  of  a  process  of  continuous  im¬ 
provement  for  one  terrorist  group  might  represent  a  major  change  in  another. 
Building  a  new  type  of  weapon  could  be  an  incremental  change  for  a  group  that  was 
experienced  in  machining  weapons;  adopting  the  same  weapon  would  be  a  much 
more  drastic  shift  for  a  group  without  that  experience.  Consequently,  an  analysis 
built  on  an  understanding  of  how  a  terrorist  group  learns  needs  to  address  changes  in 
a  group’s  activities  over  time.  For  instance,  information  on  changes  can  help  to  assess 
whether  a  given  terrorist  event  is  consistent  with  or  is  a  significant  departure  from  a 
group’s  past  learning  history.  It  could  also  assist  in  evaluating  whether  a  specific 
threat  is  credible:  The  further  a  threat  diverges  from  the  terrorist  group’s  past  efforts 
and  the  more  extreme  the  learning  requirements  for  carrying  it  out  successfully  are, 
the  less  credible  it  is. 


Difficulties  in  Measuring  the  Results  of  Learning 

Throughout  this  report,  we  have  largely  assumed  that  law  enforcement  or  intelligence 
analysts  could  readily  recognize  and  unambiguously  measure  the  effects  of  terrorist 
group  learning.  However,  while  the  general  concept  of  learning  is  easy  to  articulate,  it 
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is  much  more  difficult  to  understand  fully  and  measure  all  of  the  changes  that  result 
from  learning  in  an  organization. 

In  general,  the  result  of  learning  is  a  change  in  an  organization’s  “level  of 
knowledge.”  If,  by  evaluating  its  behaviors  or  pursuing  new  options  or  technologies, 
an  organization  gains  knowledge  that  could  improve  its  performance — even  if  it  has 
not  yet  put  that  knowledge  to  use — it  has  learned.  But  measuring  the  results  of  a 
group’s  learning  process  entails  gathering  data  on  how  its  stock  of  knowledge 
changed  as  a  result  of  its  learning  effort.  It  is  difficult  to  assess  changes  in  the  level  of 
knowledge  within  an  organization  because  measures  of  that  knowledge  are  largely 
inaccessible  to  the  outside  analyst.4 

Measuring  learning,  therefore,  is  frequently  driven  toward  observable  indicators 
of  either  an  organization’s  potential  for  change  or  the  results  of  its  change  efforts  as  a 
proxy  for  direct  measurement.5  For  incremental  change,  such  indicators  include  ob¬ 
servable  changes  in  the  way  a  group  carries  out  its  activities  (coupled  with  any  infor¬ 
mation  on  the  reasons  for  the  changes)  and  the  results  of  those  activities.  For  discon¬ 
tinuous  change,  indicators  include  group  discussions  about  and  considerations  of 
new  activities  or  changes  and  observable  shifts  in  group  practices  after  such  changes 
are  implemented.  Reliance  on  observable  data  risks  missing  components  of  learning 
that  do  not  produce  obvious  results,  but  it  does  capture  many  relevant  outputs. 

There  is  a  range  of  potential  observable  indicators  for  both  continuous  and  dis¬ 
continuous  change  in  terrorist  groups.  Novelty  is  a  clear  signal:  When  a  group  adopts 
a  new  weapon  or  uses  a  new  tactic,  the  shifts  in  group  behavior  are  most  clear.  There 
are  also  a  number  of  potential  observable  indicators  of  continuous  improvement  in 
terrorist  organizations,  including  improvements  in  a  group’s  ability  to 

•  Evade  penetration  and  arrest 

•  Use  its  chosen  weapons  accurately  and  effectively 

•  Reliably  and  reproducibly  execute  particular  operations 

•  Gather  timely  and  relevant  intelligence 

•  Stage  attacks  resulting  in  increasing  economic  damage 

•  Increase  the  numbers  of  fatalities  and  injuries  per  attack 


4  For  example,  Bohn  (1994)  frames  the  measurement  of  learning  in  terms  of  the  understanding  and  control  a 
group  has  over  the  technologies  and  techniques  it  is  using.  While  such  an  approach  is  attractive  because  it  directly 
addresses  how  consistently  and  effectively  a  group  can  apply  those  tools,  it  is  difficult  to  measure  the  results  from 
outside  the  group. 

5  The  terrorist  group  itself  may  also  have  difficulty  in  observing  the  effects  of  its  learning  activities.  In  some  areas, 
group  members  will  be  able  to  get  information  to  assess  their  activities  and  guide  future  efforts — for  example, 
data  on  the  performance  of  weapons  reported  by  their  users  or  information  on  how  far  improvised  rockets  flew 
and  their  accuracy  from  media  reports.  In  other  areas,  such  as  specific  details  of  the  performance  of  explosive 
devices,  most  of  the  “data”  will  be  impossible  to  collect  or  interpret  because  of  the  violence  of  the  event.  In  such 
cases,  even  the  terrorist  group  itself  must  base  its  judgments  on  the  available  directly  observable  information  and 
on  theories  about  why  operations  evolved  or  devices  performed  as  they  did. 
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Despite  the  variety  of  potential  metrics,  it  is  not  always  immediately  clear  how  to  as¬ 
sess  changes  with  respect  to  terrorist  group  learning.  Not  all  change  is  learning;  to  be 
considered  learning,  the  change  must  benefit  the  organization  in  its  effort  to  accom¬ 
plish  its  goals.  As  a  result,  to  measure  learning,  the  analyst  must  be  able  to  measure 
not  just  change,  but  how  that  change  increases  the  effectiveness  of  the  group’s  actions 
or  increases  their  probability  of  success.6  This  requirement  highlights  two  problems: 

•  Difficulty  in  selecting  appropriate  indicators  for  terrorists'  tactical-level  activi¬ 
ties.  Since  it  is  not  always  clear  what  a  group  is  trying  to  accomplish  in  a  given 
operation,  it  may  not  be  obvious  which  indicators  are  appropriate  for  compar¬ 
ing  a  group’s  “tactical  performance”  in  different  operations.7 

•  Difficulties  linking  observable  indicators  to  terrorist  group  strategic  progress. 
Because  it  is  difficult  to  draw  a  clear  link  between  terrorists’  activities  at  the  tac¬ 
tical  level — i.e.,  individual  operations — and  progress  toward  the  group’s  strate¬ 
gic  goals  (which  may  be  unknown  or  not  completely  known),  it  is  often  unclear 
whether  or  not  changes  in  “tactical  performance”  help  or  hurt  the  group’s 
chances  of  strategic  success. 

Difficulties  in  Selecting  Appropriate  Indicators  for  Terrorists' 

Tactical-Level  Activities 

To  determine  whether  the  results  of  a  particular  terrorist  attack,  from  the  perspective 
of  the  terrorist  organization,  are  better  or  worse  than  those  of  a  previous  one,  the 
analyst  needs  some  insight  into  what  the  group  was  trying  to  accomplish.  For  exam¬ 
ple,  a  bombing  operation  might  be  intended  to  result  in  economic  damages,  human 
casualties,  or  both.  Having  some  picture  of  the  goals  of  an  operation — whether 
through  collecting  information  directly  or  by  having  enough  circumstantial  data  to 
make  an  educated  guess — is  necessary  to  select  the  right  indicators  to  describe  its  re¬ 
sults  and  compare  them  to  previous  attacks  by  the  same  group.  Measuring  an  attack 
with  the  wrong  yardstick — e.g.,  assessing  a  bombing  aimed  at  causing  fatalities  as  if  it 
were  intended  to  damage  economic  targets,  or  vice  versa — can  result  in  erroneous 
conclusions  about  a  group’s  learning  efforts.  Individual  indicators  that  are  relevant 
for  specific  terrorist  groups  in  some  circumstances8  will  not  be  relevant  in  others. 


6  This  difficulty  has  led  some  researchers  away  from  definitions  of  learning  that  include  such  value  judgments  and 
toward  definitions  that  focus  only  on  change  or  on  other  measures  that  are  independent  of  the  end  result  of  the 
changes. 

7  This  is  further  complicated  by  the  fact  that  a  group’s  tactical  goals  may  shift  over  time  as  its  strategy  evolves. 
However,  changes  in  performance  can  help  shed  light  on  the  terrorist  group’s  goals. 

8  The  results  of  the  case  studies  indicate  that  such  tactical  indicators  appear  easiest  to  apply  to  groups  engaged  in 
ongoing  terrorist-insurgent  campaigns,  such  as  PIRA  or  Hizballah.  (See  also  Moghadam,  2003,  p.  79,  which  dis¬ 
cusses  similar  issues  vis-Tvis  Palestinian  suicide  bombings.) 
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Difficulties  Linking  Observable  Indicators  to  Terrorist  Group 
Strategic  Progress 

Although  some  results  of  terrorists’  tactical  activities,  such  as  victims  injured  and 
physical  or  economic  damage,  are  easy  to  observe,  connecting  those  results  to  the  out¬ 
comes  the  organization  is  trying  to  attain  is  much  less  clear.  Assessing  whether  or  not 
change  actually  benefits  an  organization’s  chances  of  being  strategically  successful  is 
quite  difficult.9  It  is  not  clear,  for  example,  how  a  terrorist  group  gaining  a  particular 
new  weapon  or  increasing  its  level  of  lethality  affects  the  group’s  chance  of  strategic 
success  without  the  benefit  of  hindsight  after  the  impact  of  the  changes  has  played 
out  and  been  resolved.  The  same  change  could  be  either  beneficial  or  detrimental  for 
different  groups.  For  example,  killing  more  people  per  attack  may  be  in  a  terrorist 
group’s  long-term  strategic  interest  if  its  goals  can  be  accomplished  by  constantly 
ramping  up  the  fatalities  it  causes.  However,  significant  increases  in  fatalities  could 
strategically  hurt  a  group  that  is  trying  to  maintain  a  moderate  image  and  maintain  a 
level  of  legitimacy,  e.g.,  for  eventual  participation  in  political  negotiations.  This 
makes  learning  at  this  higher,  strategic  level  extremely  difficult  to  measure  and  as¬ 
sess.10 


Understanding  the  Contribution  of  Learning  Ability  to 
Specific  Terrorist  Operations 

Understanding  how  a  terrorist  group  learns  is  always  very  useful  for  estimating  how 
successful  the  group  will  be  in  developing  new  capabilities  or  acquiring  new  tactics. 
But  such  understanding  is  not  always  as  useful  for  assessing  the  group’s  chances  of 
success  in  specific  operations.  Depending  on  the  types  of  targets  a  terrorist  group 
chooses  to  attack,  significant  learning — intelligence  gathering,  modification  of  opera¬ 
tional  plans,  or  even  development  of  particular  weapons — may  be  needed  before  an 
operation  can  be  carried  out  successfully  (Bell,  1998a,  p.  262).  Groups  that  select 
high-profile,  well-protected  targets  because  of  their  visibility  or  attractiveness  from  a 
prestige  perspective  may  have  to  be  particularly  good  learners.  Analytical  approaches 
based  on  learning  can  be  useful  in  assessing  the  activities  of  these  groups  and  the 
chance  that  they  will  be  able  to  carry  out  their  plans. 

In  other  circumstances,  a  terrorist  group  may  not  need  to  learn  very  much  to 
plan  an  operation  and  carry  it  out  successfully.  If  a  group  focuses  on  selecting  vulner¬ 
able  targets — sites  or  individuals  it  can  attack  successfully  with  the  weapons  and  tac- 


9  See  Merari,  1993,  pp.  224-242,  for  a  discussion  of  levels  of  strategic  success  resulting  from  terrorist  violence. 

10  In  addition  to  affecting  the  ability  of  the  analyst  or  researcher,  such  difficulties  also  affect  decisionmakers 
within  the  terrorist  organizations.  The  ambiguities  in  the  impact  of  changes  on  strategic  success  therefore  hurt 
groups’  ability  to  interpret  their  own  actions  and  outcomes  as  they  try  to  craft  strategy  and  tactics. 
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tics  it  has  available11 — there  may  be  few  learning  requirements.12  Learning  capabili¬ 
ties  will  be  less  of  a  factor  determining  the  success  or  failure  of  these  attacks. 

Analysis  can  be  further  complicated  by  the  fact  that  a  single  terrorist  group  may 
not  fall  cleanly  into  one  of  these  two  categories.  As  a  group’s  strategy  changes  or  its 
focus  shifts  over  time,  the  way  it  chooses  its  targets  may  change,  moving  it  from  one 
category  to  the  other.  Such  a  behavioral  shift  was  observed  in  JI.  Some  of  the  opera¬ 
tions  it  selected  involved  high-profile,  hardened  targets  and  as  a  result  involved  con¬ 
siderable  learning;  other  targets  were  apparently  selected  because  they  were  soft  and 
accessible  (Baker,  2005).  Similarly,  different  cells  within  a  single  terrorist  group  may 
have  different  targeting  strategies.  Some  units  within  PIRA  reportedly  selected  targets 
almost  entirely  based  on  their  vulnerability;  in  other  cases,  specialized  teams  identi¬ 
fied  high-profile  attack  opportunities  and  carried  out  the  full  complement  of  learning 
processes  required  to  mount  the  operations  (Jackson,  2005). 13  Because  of  such  differ¬ 
ences,  the  analyst  using  an  organizational-learning-based  model  must  understand 
how  the  terrorist  group’s  targeting  behavior  might  affect  the  impact  of  its  learning 
ability  on  its  chances  of  operational  success,  and  vice-versa. 


11  Note  that  this  qualification  does  not  discount  the  importance  of  the  terrorist  group’s  learning  ability  for  put¬ 
ting  those  capabilities  in  place  initially. 

12  Significant  learning  may  be  required  before  a  terrorist  group  develops  the  skills  needed  to  successfully  select 
such  vulnerable,  or  “soft,”  targets. 

13  Although  not  the  primary  focus  of  this  discussion,  the  particular  targeting  strategy  a  terrorist  group  adopts  and 
the  learning  requirements  for  successfully  carrying  out  that  strategy  could  have  a  significant  impact  on  target 
hardening  and  the  design  of  other  countermeasures.  For  terrorist  groups  that  primarily  select  targets  based  on 
vulnerability  to  current  attack  options,  comparatively  modest  security  measures — “just  enough  to  bring  the  target 
above  the  group’s  available  capabilities” — should  be  sufficient  to  deter  attack.  For  terrorist  groups  that  are  willing 
and  able  to  commit  significant  learning  resources  to  attacking  desirable  targets,  the  targets  would  have  to  be  hard¬ 
ened  beyond  the  terrorists’  ability  to  overcome  the  security  through  learning.  This  is  a  much  higher  threshold  for 
design. 


CHAPTER  SIX 

Conclusions 


To  protect  the  public  against  the  threat  posed  by  terrorist  organizations,  law  en¬ 
forcement  and  intelligence  organizations  must 

•  Assess  the  threat  and  understand  the  behavior  of  individual  terrorist  groups 

•  Develop  and  implement  effective  counterstrategies  to  detect  and  thwart  terrorist 
groups’  efforts 

•  Appropriately  allocate  resources  against  potential  and  proven  adversaries  and 
develop  metrics  to  assess  the  effectiveness  of  measures  for  combating  terrorism 

Studying  how  terrorist  groups  learn  can  be  a  valuable  addition  to  the  intelligence  and 
law  enforcement  “tool  box”  to  help  in  accomplishing  all  three  of  these  tasks. 


Assessing  the  Threat  Posed  by  Individual  Terrorist  Groups 
and  Understanding  Their  Behavior 

Examining  the  behavior  of  terrorist  groups  from  an  organizational  learning  perspec¬ 
tive  presents  a  mixed  picture  of  their  successes  and  failures.  Certain  groups  have 
shown  very  significant  capacities  to  learn  and  innovate,  competing  effectively  with 
law  enforcement  and  intelligence  organizations  and  building  the  capabilities  needed 
to  carry  out  complex  operations.  Others  have  had  difficulty  learning  effectively  and 
have  been  limited  in  their  ability  to  adapt  to  changing  circumstances.  Terrorist 
groups  are  not  uniform  in  their  learning  capability,  adapting  very  effectively  in  some 
areas,  while  remaining  largely  unsuccessful  in  others.  Because  learning  contributes 
directly  to  the  threat  level  of  a  terrorist  group — by  determining  the  tactics  it  could 
bring  to  bear,  the  weapons  it  could  have  available,  and  the  operations  it  could  plan 
and  execute — understanding  learning  capabilities  is  a  key  element  of  threat  assess¬ 
ment. 

Modeling  the  way  terrorist  groups  learn  can  also  provide  a  way  to  analyze  or 
project  potential  changes  in  their  threat  level  over  time.  A  framework  for  under¬ 
standing  group  learning  activities  could  help  inform  analysts  about  a  group’s  efforts 
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to  pursue  new  capabilities,  weapons,  or  tactics.  A  learning-focused  approach  could 
similarly  assist  in  more  fully  understanding  the  potential  implications  on  group 
learning  of  specific  activities,  from  engaging  state  sponsors  to  gaining  safe  havens  for 
experimentation  and  training.  Projections  of  how  terrorist  groups  will  change  in  the 
future  based  only  on  the  past  history  of  those  groups  are  essentially  educated  guesses. 
To  the  extent  that  an  analyst  can  truly  understand  the  processes  through  which  a 
group  adapts,  those  projections  can  become  real  forecasts,  enabling  better  planning 
and  policy  design  for  combating  terrorism. 


Developing  and  Implementing  Effective  Counterstrategies 

While  an  understanding  of  organizational  learning  in  terrorist  groups  provides  no 
“silver  bullet”  for  addressing  the  problem  of  terrorism,  it  does  provide  a  knowledge 
base  for  developing  new  strategies  to  target  these  groups’  activities  and  undermine 
their  capabilities.  A  deeper  understanding  of  learning  can  better  illuminate  the  recip¬ 
rocal  relationship  between  actions  to  combat  terrorism  and  terrorist  groups’  learning 
efforts.  Actions  aimed  at  infiltrating  and  undermining  terrorist  organizations  can 
have  both  positive  and  negative  effects  on  their  learning  activities.  The  better  possible 
reactions  can  be  understood,  the  greater  the  chance  that  law  enforcement  or  intelli¬ 
gence  actions  can  be  designed  to  shape  those  reactions  to  the  public’s  benefit  rather 
than  to  the  terrorists’  advantage. 

Organizational-learning-based  models  can  provide  alternative  approaches  to  the 
terrorism  problem.  Such  alternative  frameworks  and  approaches  for  undermining 
components  of  terrorists’  activities  may  be  accessible  even  when  more  traditional  ap¬ 
proaches  are  not.  Alternatively,  they  might  play  an  important  complementary  or 
supplemental  role,  an  additional  ingredient  in  a  comprehensive,  multifront  approach 
to  countering  terrorist  violence. 


Allocating  Resources  and  Developing  Metrics  to  Assess 
the  Effectiveness  of  Efforts  to  Combat  Terrorism 

Because  the  resources  available  for  combating  terrorism  are  finite,  decisions  must  be 
made  about  how  those  resources  should  be  allocated.  There  will  frequently  be  more 
worthwhile  leads,  promising  tips,  or  potential  threats  than  there  are  resources  to  pur¬ 
sue  them.  Allocating  resources  among  all  the  potential  avenues  of  investigation  and 
among  all  the  possible  terrorist  groups  that  could  pose  a  threat  to  the  public  and  the 
nation  is  therefore  a  critical  challenge.  The  goal  is  to  press  hardest  on  groups  that 
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pose  the  most  significant  proven  or  potential  threat — groups  that  do  not  just  have 
plans  and  intent,  but  can  readily  build  the  capabilities  to  carry  out  those  plans.  If  re¬ 
sources  for  combating  terrorism  are  arrayed  against  the  wrong  groups  or  devoted  to 
pursuing  threats  that  are  not  credible,  they  will  be  diverted  from  pursuing  more- 
dangerous  terrorist  groups. 

It  is  a  group’s  ability  to  learn  that  connects  what  it  wants  to  do  with  the  capa¬ 
bility  to  do  it  successfully.  A  terrorist  group’s  ability  to  adapt  and  evolve  enables  it  to 
gather  the  intelligence  needed  to  stage  attacks,  to  acquire  the  tactics  and  weapons 
necessary  for  its  operations,  and  to  circumvent  the  security  and  other  countermea¬ 
sures  protecting  its  desired  targets  in  the  dynamic  world  of  countermeasures.  An 
understanding  of  how  terrorist  groups  learn  can,  therefore,  contribute  to  decisions 
about  how  to  allocate  available  resources  for  combating  terrorism.  Organizations  that 
are  good  learners  are  potentially  more  serious  threats.  For  groups  acting  as  parts  of 
international  terrorist  networks,  providing  assistance  to  or  cooperating  with  other 
terrorist  groups,  the  ability  to  learn  is  of  serious  concern  because  of  what  good  learn¬ 
ers  can  bring  to  such  interactions  as  well  as  what  they  can  gain  from  them. 

Terrorist  groups  whose  efforts  are  more  likely  to  succeed  present  a  more  credible 
threat  and  should  be  a  higher  priority  for  law  enforcement  and  intelligence  agencies. 
Groups  that  can  learn  effectively  may  therefore  merit  special  attention  and  resources, 
both  in  an  effort  to  degrade  their  learning  capabilities  and  because  that  learning  abil¬ 
ity  may  make  them  particularly  difficult  targets  for  countereflforts.  To  the  extent  that 
the  law  enforcement  or  intelligence  analyst  can  identify  terrorist  groups  that  cannot 
learn  or  that  learn  with  more  difficulty,  other  options  become  available.  Groups  that 
do  not  learn  well  may  be  particularly  vulnerable — minimal  action  could  permanently 
remove  or  reduce  the  threat  they  pose,  essentially  neutralizing  them  in  a  way  that 
permits  law  enforcement  and  intelligence  resources  to  be  allocated  to  more-pressing 
threats. 

An  understanding  of  terrorist  group  learning  efforts  can  similarly  contribute  to 
the  development  of  better  metrics  for  assessing  efforts  to  combat  terrorism.  To  mea¬ 
sure  the  effectiveness  of  counterefiforts,  an  analyst  must  be  able  to  assess  the  impact  of 
those  efforts  on  terrorist  group  activities.  Reductions  in  terrorist  group  capabilities, 
disruption  in  operations,  limiting  groups’  ability  to  successfully  stage  specific  types  of 
attacks,  or  capture  of  key  assets  or  individuals  could  be  reasonable  components  of 
such  metrics.  An  understanding  of  terrorist  group  learning  could  improve  the 
breadth  and  accuracy  of  metrics  for  assessing  efforts  to  combat  terrorism,  for  exam¬ 
ple,  by  contributing  to  better  measures  of  the  effects  of  counterefforts  on  groups’ 
capabilities,  estimates  of  how  easily  groups  can  learn  to  defeat  the  countermeasures, 
or  assessments  of  the  importance  of  specific  captured  individuals  to  groups’  learning 
capability. 
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Concluding  Remarks 

This  research  effort  began  with  two  straightforward  questions: 

•  What  is  known  about  how  terrorist  groups  learn? 

•  Can  law  enforcement  and  intelligence  use  knowledge  about  group  learning  in 
their  efforts  to  combat  terrorism? 

Our  analysis  of  five  case  study  groups  and  our  discussions  with  law  enforcement 
and  intelligence  professionals  provided  answers  to  both  questions,  suggesting  ways 
that  knowledge  about  organizational  learning  can  be  applied  now  and  also  suggesting 
areas  that  require  more  attention  to  produce  the  greatest  benefits  for  combating  ter¬ 
rorism.  It  is  easiest  to  address  these  two  questions  in  reverse  order. 

The  answer  to  the  second  question  is  an  emphatic  “yes.”  Because  of  the  impor¬ 
tance  of  organizational  learning  and  the  variety  of  strategies  through  which  knowl¬ 
edge  of  terrorist  group  learning  could  be  applied  in  analysis  and  operational  plan¬ 
ning,  understanding  organizational  learning  and  collecting  information  about  how 
terrorist  groups  learn  could  be  very  valuable.  Our  discussions  with  law  enforcement 
and  intelligence  professionals  indicated  that  application  of  a  learning-focused  ap¬ 
proach  to  analyzing  information  about  terrorist  groups  and  planning  operations 
aimed  at  thwarting  their  efforts  could  provide  real  benefits. 

The  answer  to  the  first  question  is  more  mixed.  Information  on  the  ways  even 
prominent,  well-studied  terrorist  organizations  learn  is  difficult  to  obtain.  Some  in¬ 
sights  about  learning  can  be  extracted  from  studies  that  have  been  carried  out  for 
other  reasons,  but  blind  spots  remain,  particularly  regarding  the  most  internal  com¬ 
ponents  of  the  process,  such  as  interpretation  and  decisionmaking  activities.  Yet  these 
internal  components  are  perhaps  of  greatest  interest  to  the  analyst  studying  terrorist 
groups’  learning  behavior.  Information  on  groups  that  have  garnered  less  analytical 
attention  would  likely  be  even  more  difficult  to  obtain. 

Therefore,  consistent  with  the  exploratory  nature  of  this  project,  it  is  clear  that 
we  need  to  know  more.  To  build  a  better  and  broader  understanding  of  organiza¬ 
tional  learning  in  terrorist  groups,  more  information  is  needed — particularly  the  first- 
person,  internal  information  available  in  accounts  of  former  group  members  or  col¬ 
lected  from  current  members  when  opportunities  present  themselves.  Beyond  the 
need  for  additional  data,  our  research  identified  other  avenues  that  should  be  ex¬ 
plored  and  hypotheses  that  should  be  tested  in  an  effort  to  provide  more  effective 
tools  for  combating  terrorism.  However,  in  spite  of  the  need  for  further  investigation, 
it  is  our  hope  that  the  results  presented  here  can  make  a  contribution  to  ongoing  ef¬ 
forts  against  terrorist  organizations  and  can  assist  in  developing  increasingly  effective 
strategies  to  protect  society  from  terrorist  violence. 


APPENDIX 

Overview  of  the  Case  Study  Groups 


Aum  Shinrikyo 

Officially  registered  with  the  Japanese  government  as  a  religious  group,  Aum  Shinri¬ 
kyo  (Supreme  Truth)  gradually  evolved  into  a  terrorist  organization  that  conducted 
assassinations,  ran  programs  to  develop  and  procure  unconventional  weapons,  plot¬ 
ted  to  overthrow  the  Japanese  government,  and  contemplated  cataclysmic  war  with 
the  United  States.  Aum,  founded  in  1984  by  Shoko  Asahara,  the  organization’s 
charismatic  leader  and  spiritual  guru,  began  as  a  15-person  yoga  and  meditation 
group.  Eight  years  later,  it  had  grown  into  a  movement  with  nearly  50,000  members, 
hundreds  of  millions  of  dollars  in  assets,  and  facilities  or  activities  in  Japan,  the 
United  States,  Germany,  Russia,  Taiwan,  and  Sri  Lanka.  Eventually,  the  group  suf¬ 
fered  political  defeat  and  had  growing  difficulties  recruiting  and  retaining  members, 
after  which  its  rhetoric  became  increasingly  apocalyptic,  paranoid,  and  violent. 
Asahara  claimed  that  the  organization  had  a  divine  mission  to  hasten  the  apocalypse 
with  the  expectation  that  the  only  survivors  would  be  the  devout  followers  of  Aum. 
His  inner  circle  of  devotees  ran  the  group’s  programs  to  acquire  weapons  of  mass  de¬ 
struction,  conducted  its  violent  attacks,  and,  by  some  accounts,  also  attempted  to 
cause  an  event  with  mass  casualties  to  confirm  the  guru’s  apocalyptic  prophesies. 
Japanese  authorities  were  slow  to  admit  to  the  threat  posed  by  Aum,  partly  because  of 
long-standing  police  reticence  to  engage  in  investigations  that  could  be  seen  as  perse¬ 
cution  of  a  religious  group.  After  Aum’s  1995  sarin  attack  on  the  Tokyo  subway,  the 
Japanese  government  stripped  it  of  its  religious-organization  status  and  seized  its 
assets;  the  government  also  placed  several  key  cult  members,  including  Asahara,  on 
trial.  Residual  elements  of  Aum  continue  to  exist,  although  the  organization’s  name 
has  been  changed  to  Aleph. 

Selected  High-Profile  Incidents 

1993  Unsuccessful  attempts  to  manufacture  and  release  anthrax  around  Tokyo 

1994  Release  of  sarin  in  a  residential  neighborhood  in  Matsumoto,  Japan 

1995  Release  of  sarin  on  the  Tokyo  subway  system 
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Hizballah 

Hizballah  is  a  militant  Islamic  organization  based  in  southern  Lebanon.  It  began  to 
operate  as  a  guerrilla  organization  in  1982,  after  the  Israeli  military  occupied  south¬ 
ern  Lebanon  in  an  effort  to  eliminate  incursions  into  Israel  by  Palestinian  guerrillas 
using  the  area  as  a  base  of  operations.  The  group’s  original  goal  was  to  compel  the 
Israeli  military  to  withdraw  from  southern  Lebanon.  Toward  that  end,  it  carried  out 
a  series  of  terrorist  attacks,  including  kidnappings,  hijackings,  and  suicide  bombings, 
and  engaged  in  guerrilla  warfare  against  Western  and  Israeli  targets.  Hizballah  began 
as  a  collection  of  loosely  associated  militia  groups  trained  and  organized  by  the  Ira¬ 
nian  Revolutionary  Guards.  In  1988,  these  various  groups  came  under  a  central 
command.  Throughout  its  existence,  Hizballah  has  maintained  a  core  fighting  force 
ranging  in  size  from  approximately  500  to  4,000  members.  Ideologically,  it  is  a 
Shi’ite  organization,  placing  Iran  at  the  center  of  its  religious  and  pan-Islamic  world¬ 
view,  but  it  combines  this  Islamic  orientation  with  strong  Lebanese  nationalism. 
Over  the  years,  Hizballah  has  benefited  from  the  sponsorship  of  Iran  and  Syria, 
which  have  provided  the  group  with  financial  support,  training,  and  arms.  Along 
with  guerrilla  warfare,  Hizballah  has  mounted  various  terrorist  operations  against  its 
adversaries,  including  hostage-taking,  suicide  bombings,  and  Ketusha  rocket  attacks 
against  civilian  targets  in  northern  Israel.  In  2000,  Hizballah  achieved  its  primary 
objective  when  the  Israeli  military  unilaterally  withdrew  from  southern  Lebanon. 
Subsequently,  Hizballah  has  concentrated  on  transforming  itself  into  a  political  orga¬ 
nization.  Members  of  the  group  first  ran  successfully  for  Parliament  in  1992.  Hiz¬ 
ballah  has  also  continued  a  low  level  of  attacks  against  Israel  in  the  Golan  Heights 
and  more  indirectly  through  its  support  of  various  Palestinian  groups  fighting  the 
Israelis. 

Selected  High-Profile  Incidents 

1980s  Abductions  of  nearly  100  Westerners,  including  the  president  of  the  Ameri¬ 
can  University  in  Beirut,  the  CIA  station  chief  (who  was  later  killed),  and 
the  British  special  envoy  of  the  Archbishop  of  Canterbury 
1983  Suicide  bombings  of  buildings  housing  UN  peacekeeping  forces  in  Beirut, 
killing  both  U.S.  Marines  and  French  paratroopers;  a  subsequent  truck 
bomb  attack  on  the  U.S.  embassy  in  Beirut 
1985  Hijacking  of  Trans-World  Airlines  flight  847,  which  ended  with  the  execu¬ 
tion  of  a  passenger  who  was  in  the  U.S.  Navy 
1992  Bombing  of  the  Israeli  embassy  in  Argentina 

1996  Suspected  involvement  in  the  truck  bombing  of  the  Khobar  Towers,  which 
housed  U.S.  military  personnel  in  Saudi  Arabia 
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Jemaah  Islamiyah 

Jemaah  Islamiyah  (JI)  is  a  militant  Islamist  group  operating  in  Southeast  Asia.  Its 
goal  is  to  establish  separate  Islamic  communities  in  the  area  as  a  precursor  to  the  crea¬ 
tion  of  a  pan-regional  Islamic  caliphate.  JI  views  jihad  (holy  war)  as  essential  to 
achieving  this  vision.  JI  coalesced  in  the  mid-1990s  as  an  increasingly  organized  net¬ 
work  of  individuals  who  used  terrorism  and  other  forms  of  violence  to  achieve  their 
goals.  It  has  been  closely  linked  with  al  Qaeda  and  operatives  involved  in  jihad  in  Af¬ 
ghanistan.  Over  its  history,  the  group  has  had  active  cells  in  several  different  coun¬ 
tries,  including  Indonesia,  Malaysia,  the  Philippines,  and  Singapore,  and  has  devel¬ 
oped  a  core  group  of  dedicated  and  well-trained  operatives,  which  likely  total  several 
hundred.  Its  operatives  have  staged  infrequent,  but  highly  effective,  bombing  attacks 
in  Indonesia  and  the  Philippines  and  have  plans  for  attacks  in  Singapore  and  other 
Southeast  Asian  countries.  Since  2001,  increased  counterterrorism  operations  have 
resulted  in  the  arrest  or  killing  of  many  JI  personnel,  including  the  group’s  spiritual 
leader,  Abu  Bakar  Ba’asyir.  Nonetheless,  JI,  or  at  least  a  subgroup  of  its  operatives, 
has  demonstrated  a  continuing  ability  to  undertake  major  attacks. 

Selected  High-Profile  Incidents 

2000  Bombings  of  churches  across  Indonesia  on  Christmas  Eve 

2002  Bombing  of  two  nightclubs  in  Bali 

2003  Bombing  of  the  J.W.  Marriott  Hotel  in  Jakarta 

2004  Bombing  of  the  Australian  embassy  in  Jakarta 


The  Provisional  Irish  Republican  Army 

The  goals  of  the  Provisional  Irish  Republican  Army  (PIRA)  were  defined  by  the  long 
history  of  the  Irish  Republican  movement.  PIRA  came  into  being  in  1969,  splinter¬ 
ing  from  the  rest  of  the  Republican  movement  because  of  differences  in  political  and 
military  strategy.  Drawing  on  long-standing  Republican  traditions  that  called  for 
violence  as  the  means  of  pursuing  nationalist  goals,  PIRA  defined  itself  as  a  military 
entity.  But  understanding  that  it  could  not  directly  confront  the  British  armed  forces, 
it  utilized  terrorism  and  insurgent  violence.  PIRA’s  main  targets  were  the  British  and 
the  Loyalists  of  Northern  Ireland,  who  were  committed  to  remaining  part  of  the 
United  Kingdom.  Religion  defined  the  nature  of  the  conflict,  as  Republicans  were 
primarily  Catholic  and  Loyalists  were  predominantly  Protestant.  For  nearly  30  years, 
PIRA  conducted  the  vast  majority  of  its  operations  in  Northern  Ireland  and  on  the 
British  mainland,  with  additional  attacks  or  activities  in  the  Irish  Republic,  continen¬ 
tal  Europe,  and  the  United  States.  In  1997,  PIRA  agreed  to  a  ceasefire  as  part  of  the 
regional  peace  process  and  stopped  its  terrorist  operations. 
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Selected  High-Profile  Incidents 

1979  Assassination  of  Lord  Mountbatten,  a  relative  of  Queen  Elizabeth  II 

1993  A  large-scale  car  bombing  at  Bishopsgate  in  London’s  financial  district 

1994  Mortar  attacks  on  London’s  Heathrow  Airport 


The  Radical  Environmentalist  Movement 

The  Earth  Liberation  Front  (ELF)  and  the  Animal  Liberation  Front  (ALF)  are  the 
most  prominent  terrorist  elements,  or  “fronts,”  within  the  radical  environmental 
movement.  These  groups  are  dedicated  to  preventing  what  they  view  as  the  destruc¬ 
tion  and  exploitation  of  the  Earth  and  its  species,  both  human  and  non-human.  Be¬ 
cause  of  assumed  cross-membership  of  individuals  and  cross-fertilization  among 
many  groups  and  subunits  within  the  radical  environmental  movement,  law  en¬ 
forcement  and  counterterrorism  efforts  frequently  treat  ELF/ALF  and  affiliated 
groups  as  a  single  terrorist  “organization”  for  analytical  purposes,  while  recognizing 
that  the  groups’  diversity  adds  a  unique  dynamic.  Rejecting  the  label  of  “terrorist 
group,”  the  subgroups  instead  define  themselves  as  part  of  a  grass-roots  social  move¬ 
ment.  Individually  and  collectively,  these  groups  lack  a  formal  organizational  struc¬ 
ture  and  rely  instead  on  a  “leaderless  resistance”  approach  that  considers  any  person 
who  acts  on  its  behalf  to  be  an  agent  of  the  group,  as  long  as  his  or  her  actions  follow 
the  group’s  guidelines.  This  sets  these  movements  apart  from  the  other  groups  ex¬ 
amined  in  this  study.  During  the  past  three  decades,  more  than  1,000  criminal  acts, 
resulting  in  more  than  $100  million  in  damages,  have  been  committed  by  radical  en¬ 
vironmentalists,  including  ELF/ALF.  However,  consistent  with  the  disaggregated  na¬ 
ture  of  their  activities,  no  estimate  exists  of  the  number  of  individuals  involved.  Ar¬ 
son,  vandalism,  and  theft  are  the  ELF/ALF’s  most  frequent  actions  against  property 
targets  belonging  to  people  and  businesses  that  it  considers  to  be  engaged  in  activities 
harmful  to  the  environment  and/or  animals. 

Selected  High-Profile  Incidents 

1998  Arson  of  a  ski  resort  in  Vail,  CO,  that  caused  several  million  dollars  in  dam¬ 
age 

1999  Arson  of  the  Boise  Cascade  lumber  company 

200 1  Arson  of  the  Center  for  Urban  Horticulture  at  the  University  of  Washing¬ 

ton,  Seattle 

2003  Arson  and  vandalism  of  125  sport  utility  vehicles  at  auto  dealerships  and  in 
neighborhoods  near  Los  Angeles 
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